- Kernel - mailweb.openeuler.org

[PATCH v2 openEuler-1.0-LTS] netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
by Wang Hai 13 Aug '24

13 Aug '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v4.19.317 commit 40188a25a9847dbeb7ec67517174a835a677752f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEO4 CVE: CVE-2024-42070 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7931d32955e09d0a11b1fe0b6aac1bfa061c005c ] register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This only requires a new helper function to infer the register type from the set datatype so this conditional check can be removed. Otherwise, pointer to chain object can be leaked through the registers. Fixes: 96518518cc41 ("netfilter: add nftables") Reported-by: Linus Torvalds <torvalds(a)linuxfoundation.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: include/net/netfilter/nf_tables.h net/netfilter/nft_lookup.c [nf_tables.h conflicts due to context, nft_lookup.c conflicts because e1c59f90e1a6 ("netfilter: nftables: add nft_parse_register_store() and use it") is not merged.] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- v1->v2: change bugzilla include/net/netfilter/nf_tables.h | 5 +++++ net/netfilter/nf_tables_api.c | 8 ++++---- net/netfilter/nft_lookup.c | 2 +- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index ecc301ee1556..247e4637b458 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -438,6 +438,11 @@ static inline void *nft_set_priv(const struct nft_set *set) return (void *)set->data; } +static inline enum nft_data_types nft_set_datatype(const struct nft_set *set) +{ + return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; +} + static inline struct nft_set *nft_set_container_of(const void *priv) { return (void *)priv - offsetof(struct nft_set, data); diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 97e56cadb4bf..133cff3a3f77 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3961,8 +3961,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb, if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), - set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, - set->dlen) < 0) + nft_set_datatype(set), set->dlen) < 0) goto nla_put_failure; if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) && @@ -7174,6 +7173,9 @@ int nft_validate_register_store(const struct nft_ctx *ctx, return 0; default: + if (type != NFT_DATA_VALUE) + return -EINVAL; + if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) return -EINVAL; if (len == 0) @@ -7182,8 +7184,6 @@ int nft_validate_register_store(const struct nft_ctx *ctx, FIELD_SIZEOF(struct nft_regs, data)) return -ERANGE; - if (data != NULL && type != NFT_DATA_VALUE) - return -EINVAL; return 0; } } diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c index cb9e937a5ce0..0d7a21ec9b11 100644 --- a/net/netfilter/nft_lookup.c +++ b/net/netfilter/nft_lookup.c @@ -102,7 +102,7 @@ static int nft_lookup_init(const struct nft_ctx *ctx, priv->dreg = nft_parse_register(tb[NFTA_LOOKUP_DREG]); err = nft_validate_register_store(ctx, priv->dreg, NULL, - set->dtype, set->dlen); + nft_set_datatype(set), set->dlen); if (err < 0) return err; } else if (set->flags & NFT_SET_MAP) -- 2.17.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 146a244b7e1e972d9df692a65f5319a673798896
by kernel test robot 13 Aug '24

13 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 146a244b7e1e972d9df692a65f5319a673798896 !10871 USB: serial: mos7840: fix crash on resume Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-004-20240812 | |-- drivers-net-ethernet-cisco-enic-vnic_dev.c:warning:a0-may-be-used-uninitialized | `-- drivers-net-ethernet-cisco-enic-vnic_dev.c:warning:a1-may-be-used-uninitialized `-- x86_64-buildonly-randconfig-001-20240812 `-- mm-slab_common.o:warning:objtool:kmem_cache_create_usercopy:unreachable-instruction elapsed time: 725m configs tested: 35 configs skipped: 137 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240812 gcc-14.1.0 arm64 randconfig-002-20240812 gcc-14.1.0 arm64 randconfig-003-20240812 gcc-14.1.0 arm64 randconfig-004-20240812 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240812 clang-18 x86_64 buildonly-randconfig-002-20240812 clang-18 x86_64 buildonly-randconfig-003-20240812 gcc-12 x86_64 buildonly-randconfig-004-20240812 clang-18 x86_64 buildonly-randconfig-005-20240812 clang-18 x86_64 buildonly-randconfig-006-20240812 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240812 clang-18 x86_64 randconfig-002-20240812 clang-18 x86_64 randconfig-003-20240812 gcc-12 x86_64 randconfig-004-20240812 gcc-12 x86_64 randconfig-005-20240812 gcc-11 x86_64 randconfig-006-20240812 clang-18 x86_64 randconfig-011-20240812 clang-18 x86_64 randconfig-012-20240812 gcc-12 x86_64 randconfig-013-20240812 clang-18 x86_64 randconfig-014-20240812 clang-18 x86_64 randconfig-015-20240812 gcc-12 x86_64 randconfig-016-20240812 gcc-12 x86_64 randconfig-071-20240812 gcc-12 x86_64 randconfig-072-20240812 gcc-12 x86_64 randconfig-073-20240812 gcc-12 x86_64 randconfig-074-20240812 clang-18 x86_64 randconfig-075-20240812 gcc-12 x86_64 randconfig-076-20240812 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION a151658a1b2d88ae86a8611249c930100194e4d2
by kernel test robot 13 Aug '24

13 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: a151658a1b2d88ae86a8611249c930100194e4d2 !10823 mm/userfaultfd: reset ptes when close() for wr-protected ones Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- x86_64-buildonly-randconfig-001-20240812 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-002-20240812 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus `-- x86_64-buildonly-randconfig-003-20240812 `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) elapsed time: 725m configs tested: 40 configs skipped: 134 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240812 gcc-14.1.0 arm64 randconfig-002-20240812 clang-20 arm64 randconfig-003-20240812 gcc-14.1.0 arm64 randconfig-004-20240812 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240812 gcc-14.1.0 loongarch randconfig-002-20240812 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240812 clang-18 x86_64 buildonly-randconfig-002-20240812 clang-18 x86_64 buildonly-randconfig-003-20240812 gcc-12 x86_64 buildonly-randconfig-004-20240812 clang-18 x86_64 buildonly-randconfig-005-20240812 clang-18 x86_64 buildonly-randconfig-006-20240812 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240812 clang-18 x86_64 randconfig-002-20240812 clang-18 x86_64 randconfig-003-20240812 gcc-12 x86_64 randconfig-004-20240812 gcc-12 x86_64 randconfig-005-20240812 gcc-11 x86_64 randconfig-006-20240812 clang-18 x86_64 randconfig-011-20240812 clang-18 x86_64 randconfig-012-20240812 gcc-12 x86_64 randconfig-013-20240812 clang-18 x86_64 randconfig-014-20240812 clang-18 x86_64 randconfig-015-20240812 gcc-12 x86_64 randconfig-016-20240812 gcc-12 x86_64 randconfig-071-20240812 gcc-12 x86_64 randconfig-072-20240812 gcc-12 x86_64 randconfig-073-20240812 gcc-12 x86_64 randconfig-074-20240812 clang-18 x86_64 randconfig-075-20240812 gcc-12 x86_64 randconfig-076-20240812 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] crypto: aead,cipher - zeroize key buffer after use
by Yi Yang 12 Aug '24

12 Aug '24

From: Hailey Mothershead <hailmo(a)amazon.com> mainline inclusion from mainline-v6.10-rc1 commit 23e4099bdc3c8381992f9eb975c79196d6755210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAHJG9 CVE: CVE-2024-42229 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key. Signed-off-by: Hailey Mothershead <hailmo(a)amazon.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: crypto/aead.c crypto/cipher.c [Use kzfree instead of kfree_sensitive because commit 453431a54934 ("mm, treewide: rename kzfree() to kfree_sensitive()") not merged] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/aead.c | 3 +-- crypto/cipher.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crypto/aead.c b/crypto/aead.c index 9688ada13981..f8b2cd0567f1 100644 --- a/crypto/aead.c +++ b/crypto/aead.c @@ -45,8 +45,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kzfree(buffer); return ret; } diff --git a/crypto/cipher.c b/crypto/cipher.c index 57836c30a49a..3d3fa8d0d533 100644 --- a/crypto/cipher.c +++ b/crypto/cipher.c @@ -38,8 +38,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = cia->cia_setkey(tfm, alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kzfree(buffer); return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2024-42105
by Chen Ridong 12 Aug '24

12 Aug '24

*** BLURB HERE *** Ryusuke Konishi (1): nilfs2: fix inode number range checks fs/nilfs2/nilfs.h | 5 +++-- fs/nilfs2/the_nilfs.c | 6 ++++++ fs/nilfs2/the_nilfs.h | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] crypto: aead,cipher - zeroize key buffer after use
by Yi Yang 12 Aug '24

12 Aug '24

From: Hailey Mothershead <hailmo(a)amazon.com> mainline inclusion from mainline-v6.10-rc1 commit 23e4099bdc3c8381992f9eb975c79196d6755210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAHJG9 CVE: CVE-2024-42229 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key. Signed-off-by: Hailey Mothershead <hailmo(a)amazon.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: crypto/cipher.c [Use kzfree instead of kfree_sensitive because commit 453431a54934 ("mm, treewide: rename kzfree() to kfree_sensitive()") not merged] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/aead.c | 3 +-- crypto/cipher.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crypto/aead.c b/crypto/aead.c index 9688ada13981..f8b2cd0567f1 100644 --- a/crypto/aead.c +++ b/crypto/aead.c @@ -45,8 +45,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kzfree(buffer); return ret; } diff --git a/crypto/cipher.c b/crypto/cipher.c index 57836c30a49a..3d3fa8d0d533 100644 --- a/crypto/cipher.c +++ b/crypto/cipher.c @@ -38,8 +38,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = cia->cia_setkey(tfm, alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kzfree(buffer); return ret; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] s390/pkey: Wipe copies of clear-key structures on failure
by Li Huafei 12 Aug '24

12 Aug '24

From: Holger Dengler <dengler(a)linux.ibm.com> mainline inclusion from mainline-v6.10-rc1 commit d65d76a44ffe74c73298ada25b0f578680576073 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAH6LY CVE: CVE-2024-42156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key. Reviewed-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Ingo Franzki <ifranzki(a)linux.ibm.com> Acked-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Holger Dengler <dengler(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Conflicts: drivers/s390/crypto/pkey_api.c [ Resolved context conflict due to commit 6d749b4e0208 ("s390/pkey: introduce dynamic debugging for pkey") not backport. ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/s390/crypto/pkey_api.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c index eccee7cabf18..2cdfc83a1f82 100644 --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1151,10 +1151,8 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc = cca_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype, kcs.clrkey.clrkey, kcs.seckey.seckey); DEBUG_DBG("%s cca_clr2seckey()=%d\n", __func__, rc); - if (rc) - break; - if (copy_to_user(ucs, &kcs, sizeof(kcs))) - rc = -EFAULT; + if (!rc && copy_to_user(ucs, &kcs, sizeof(kcs))) + return -EFAULT; memzero_explicit(&kcs, sizeof(kcs)); break; } @@ -1182,10 +1180,8 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc = pkey_clr2protkey(kcp.keytype, &kcp.clrkey, &kcp.protkey); DEBUG_DBG("%s pkey_clr2protkey()=%d\n", __func__, rc); - if (rc) - break; - if (copy_to_user(ucp, &kcp, sizeof(kcp))) - rc = -EFAULT; + if (!rc && copy_to_user(ucp, &kcp, sizeof(kcp))) + return -EFAULT; memzero_explicit(&kcp, sizeof(kcp)); break; } @@ -1325,11 +1321,14 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (copy_from_user(&kcs, ucs, sizeof(kcs))) return -EFAULT; apqns = _copy_apqns_from_user(kcs.apqns, kcs.apqn_entries); - if (IS_ERR(apqns)) + if (IS_ERR(apqns)) { + memzero_explicit(&kcs, sizeof(kcs)); return PTR_ERR(apqns); + } kkey = kmalloc(klen, GFP_KERNEL); if (!kkey) { kfree(apqns); + memzero_explicit(&kcs, sizeof(kcs)); return -ENOMEM; } rc = pkey_clr2seckey2(apqns, kcs.apqn_entries, @@ -1339,15 +1338,18 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, kfree(apqns); if (rc) { kfree_sensitive(kkey); + memzero_explicit(&kcs, sizeof(kcs)); break; } if (kcs.key) { if (kcs.keylen < klen) { kfree_sensitive(kkey); + memzero_explicit(&kcs, sizeof(kcs)); return -EINVAL; } if (copy_to_user(kcs.key, kkey, klen)) { kfree_sensitive(kkey); + memzero_explicit(&kcs, sizeof(kcs)); return -EFAULT; } } -- 2.25.1

2 1

[PATCH OLK-5.10] s390/pkey: Wipe copies of clear-key structures on failure
by Li Huafei 12 Aug '24

12 Aug '24

From: Holger Dengler <dengler(a)linux.ibm.com> mainline inclusion from mainline-v6.10-rc1 commit d65d76a44ffe74c73298ada25b0f578680576073 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAH6LY CVE: CVE-2024-42156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key. Reviewed-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Ingo Franzki <ifranzki(a)linux.ibm.com> Acked-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Holger Dengler <dengler(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Conflicts: drivers/s390/crypto/pkey_api.c [ Resolved context conflict due to commit 6d749b4e0208 ("s390/pkey: introduce dynamic debugging for pkey") not backport. ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/s390/crypto/pkey_api.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c index 4f73b39a1455..1025a7bcd4db 100644 --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1151,10 +1151,8 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc = cca_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype, kcs.clrkey.clrkey, kcs.seckey.seckey); DEBUG_DBG("%s cca_clr2seckey()=%d\n", __func__, rc); - if (rc) - break; - if (copy_to_user(ucs, &kcs, sizeof(kcs))) - rc = -EFAULT; + if (!rc && copy_to_user(ucs, &kcs, sizeof(kcs))) + return -EFAULT; memzero_explicit(&kcs, sizeof(kcs)); break; } @@ -1182,10 +1180,8 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc = pkey_clr2protkey(kcp.keytype, &kcp.clrkey, &kcp.protkey); DEBUG_DBG("%s pkey_clr2protkey()=%d\n", __func__, rc); - if (rc) - break; - if (copy_to_user(ucp, &kcp, sizeof(kcp))) - rc = -EFAULT; + if (!rc && copy_to_user(ucp, &kcp, sizeof(kcp))) + return -EFAULT; memzero_explicit(&kcp, sizeof(kcp)); break; } @@ -1325,11 +1321,14 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (copy_from_user(&kcs, ucs, sizeof(kcs))) return -EFAULT; apqns = _copy_apqns_from_user(kcs.apqns, kcs.apqn_entries); - if (IS_ERR(apqns)) + if (IS_ERR(apqns)) { + memzero_explicit(&kcs, sizeof(kcs)); return PTR_ERR(apqns); + } kkey = kmalloc(klen, GFP_KERNEL); if (!kkey) { kfree(apqns); + memzero_explicit(&kcs, sizeof(kcs)); return -ENOMEM; } rc = pkey_clr2seckey2(apqns, kcs.apqn_entries, @@ -1339,15 +1338,18 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, kfree(apqns); if (rc) { kfree_sensitive(kkey); + memzero_explicit(&kcs, sizeof(kcs)); break; } if (kcs.key) { if (kcs.keylen < klen) { kfree_sensitive(kkey); + memzero_explicit(&kcs, sizeof(kcs)); return -EINVAL; } if (copy_to_user(kcs.key, kkey, klen)) { kfree_sensitive(kkey); + memzero_explicit(&kcs, sizeof(kcs)); return -EFAULT; } } -- 2.25.1

2 1

[PATCH OLK-5.10 V3] sched/fair: Prefer physical cores when migrating tasks
by Cheng Yu 12 Aug '24

12 Aug '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAJEHU CVE: NA -------------------------------- When cpu hyperthreading is enabled, one physical core can virtualize multiple logical cpus. Assume that physical core0 virtualizes two logical cpus, cpu0 and cpu1. Only when the load of cpu0 exceeds the set ratio to the capacity of cpu0, the task will be migrated to the cpu1, otherwise the task will not be migrated and the cpu0 will still be used. External impacts: 1) default config in arm64,x86: CONFIG_SCHED_KEEP_ON_CORE=y 2) sysctl: /proc/sys/kernel/sched_util_ratio 3) sched features: KEEP_ON_CORE (default NO_KEEP_ON_CORE) Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/sched/sysctl.h | 4 ++++ init/Kconfig | 12 ++++++++++ kernel/sched/fair.c | 31 ++++++++++++++++++++++++++ kernel/sched/features.h | 4 ++++ kernel/sysctl.c | 10 +++++++++ 7 files changed, 63 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 69ff0b64ba59..8c95a5332b40 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -189,6 +189,7 @@ CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y +CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index f3b810d0cf47..c2ebdb75bbe3 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -194,6 +194,7 @@ CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y +# CONFIG_SCHED_KEEP_ON_CORE is not set CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index 5cd5b3c579d3..09214349bddf 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -35,6 +35,10 @@ extern unsigned int sysctl_sched_child_runs_first; extern int sysctl_sched_util_low_pct; #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +extern int sysctl_sched_util_ratio; +#endif + #ifdef CONFIG_QOS_SCHED_SMART_GRID extern unsigned int sysctl_smart_grid_strategy_ctrl; extern int sysctl_affinity_adjust_delay_ms; diff --git a/init/Kconfig b/init/Kconfig index e552194efbea..9dcc12704729 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1370,6 +1370,18 @@ config SCHED_STEAL If unsure, say N here. +config SCHED_KEEP_ON_CORE + bool "Prefer physical cores when migrating tasks" + depends on SCHED_SMT + default n + help + When cpu hyperthreading is enabled, one physical core can virtualize + multiple logical cpus. Assume that physical core0 virtualizes two + logical cpus, cpu0 and cpu1. Only when the load of cpu0 exceeds the + ratio to the capacity of cpu0, the task will be migrated to the cpu1, + otherwise the task will not be migrated and the cpu0 will still be + used. + config CHECKPOINT_RESTORE bool "Checkpoint/restore support" select PROC_CHILDREN diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 95d1841f8a20..8dc1d2afe1b7 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7242,6 +7242,20 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu return -1; } +#ifdef CONFIG_SCHED_KEEP_ON_CORE +int sysctl_sched_util_ratio = 100; + +static int core_has_spare(int cpu) +{ + int core_id = cpumask_first(cpu_smt_mask(cpu)); + struct rq *rq = cpu_rq(core_id); + unsigned long util = rq->cfs.avg.util_avg; + unsigned long capacity = rq->cpu_capacity; + + return util * 100 < capacity * sysctl_sched_util_ratio; +} +#endif + #else /* CONFIG_SCHED_SMT */ static inline void set_idle_cores(int cpu, int val) @@ -8210,6 +8224,14 @@ select_task_rq_fair(struct task_struct *p, int prev_cpu, int sd_flag, int wake_f } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (sched_feat(KEEP_ON_CORE) && + static_branch_likely(&sched_smt_present)) { + if (core_has_spare(new_cpu)) + new_cpu = cpumask_first(cpu_smt_mask((new_cpu))); + } +#endif + rcu_read_unlock(); #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY @@ -9701,6 +9723,15 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (sched_feat(KEEP_ON_CORE) && + static_branch_likely(&sched_smt_present)) { + if (core_has_spare(env->dst_cpu) && + cpumask_first(cpu_smt_mask((env->dst_cpu))) != env->dst_cpu) + return 0; + } +#endif + /* * We do not migrate tasks that are: * 1) throttled_lb_pair, or diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 76fade025c4b..fb885b20ba34 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -70,6 +70,10 @@ SCHED_FEAT(SIS_UTIL, false) SCHED_FEAT(STEAL, false) #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +SCHED_FEAT(KEEP_ON_CORE, false) +#endif + /* * Issue a WARN when we do multiple update_rq_clock() calls * in a single rq->lock section. Default disabled because the diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 3941856c19d1..bd7b17be9ba4 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2817,6 +2817,16 @@ static struct ctl_table kern_table[] = { .extra2 = &one_hundred, }, #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + { + .procname = "sched_util_ratio", + .data = &sysctl_sched_util_ratio, + .maxlen = sizeof(sysctl_sched_util_ratio), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + }, +#endif #ifdef CONFIG_QOS_SCHED_SMART_GRID { .procname = "smart_grid_strategy_ctrl", -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] crypto: aead,cipher - zeroize key buffer after use
by Yi Yang 12 Aug '24

12 Aug '24

From: Hailey Mothershead <hailmo(a)amazon.com> mainline inclusion from mainline-v6.10-rc1 commit 23e4099bdc3c8381992f9eb975c79196d6755210 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAHJG9 CVE: CVE-2024-42229 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key. Signed-off-by: Hailey Mothershead <hailmo(a)amazon.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: crypto/cipher.c [context conflict] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/aead.c | 3 +-- crypto/cipher.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crypto/aead.c b/crypto/aead.c index 9688ada13981..e6d7816fbf2f 100644 --- a/crypto/aead.c +++ b/crypto/aead.c @@ -45,8 +45,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kfree_sensitive(buffer); return ret; } diff --git a/crypto/cipher.c b/crypto/cipher.c index 57836c30a49a..ba4193ba237b 100644 --- a/crypto/cipher.c +++ b/crypto/cipher.c @@ -38,8 +38,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = cia->cia_setkey(tfm, alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kfree_sensitive(buffer); return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10] crypto: aead,cipher - zeroize key buffer after use
by Yi Yang 12 Aug '24

12 Aug '24

From: Hailey Mothershead <hailmo(a)amazon.com> stable inclusion from stable-v5.10.222 commit 9db8c299a521813630fcb4154298cb60c37f3133 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAHJG9 CVE: CVE-2024-42229 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23e4099bdc3c8381992f9eb975c79196d6755210 ] I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key. Signed-off-by: Hailey Mothershead <hailmo(a)amazon.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/aead.c | 3 +-- crypto/cipher.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crypto/aead.c b/crypto/aead.c index 16991095270d..c4ece86c45bc 100644 --- a/crypto/aead.c +++ b/crypto/aead.c @@ -35,8 +35,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kfree_sensitive(buffer); return ret; } diff --git a/crypto/cipher.c b/crypto/cipher.c index fd78150deb1c..72c5606cc7f8 100644 --- a/crypto/cipher.c +++ b/crypto/cipher.c @@ -33,8 +33,7 @@ static int setkey_unaligned(struct crypto_cipher *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = cia->cia_setkey(crypto_cipher_tfm(tfm), alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kfree_sensitive(buffer); return ret; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] crypto: aead,cipher - zeroize key buffer after use
by Yi Yang 12 Aug '24

12 Aug '24

From: Hailey Mothershead <hailmo(a)amazon.com> stable inclusion from stable-v5.10.222 commit 9db8c299a521813630fcb4154298cb60c37f3133 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAHJG9 CVE: CVE-2024-42229 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23e4099bdc3c8381992f9eb975c79196d6755210 ] I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key. Signed-off-by: Hailey Mothershead <hailmo(a)amazon.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/aead.c | 3 +-- crypto/cipher.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crypto/aead.c b/crypto/aead.c index 16991095270d..c4ece86c45bc 100644 --- a/crypto/aead.c +++ b/crypto/aead.c @@ -35,8 +35,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kfree_sensitive(buffer); return ret; } diff --git a/crypto/cipher.c b/crypto/cipher.c index fd78150deb1c..72c5606cc7f8 100644 --- a/crypto/cipher.c +++ b/crypto/cipher.c @@ -33,8 +33,7 @@ static int setkey_unaligned(struct crypto_cipher *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = cia->cia_setkey(crypto_cipher_tfm(tfm), alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kfree_sensitive(buffer); return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10] crypto: aead,cipher - zeroize key buffer after use
by Yi Yang 12 Aug '24

12 Aug '24

From: Hailey Mothershead <hailmo(a)amazon.com> stable inclusion from stable-v5.10.222 commit 9db8c299a521813630fcb4154298cb60c37f3133 category: bugfix bugzilla: 190216 CVE: CVE-2024-42229 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23e4099bdc3c8381992f9eb975c79196d6755210 ] I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key. Signed-off-by: Hailey Mothershead <hailmo(a)amazon.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/aead.c | 3 +-- crypto/cipher.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crypto/aead.c b/crypto/aead.c index 16991095270d..c4ece86c45bc 100644 --- a/crypto/aead.c +++ b/crypto/aead.c @@ -35,8 +35,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kfree_sensitive(buffer); return ret; } diff --git a/crypto/cipher.c b/crypto/cipher.c index fd78150deb1c..72c5606cc7f8 100644 --- a/crypto/cipher.c +++ b/crypto/cipher.c @@ -33,8 +33,7 @@ static int setkey_unaligned(struct crypto_cipher *tfm, const u8 *key, alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1); memcpy(alignbuffer, key, keylen); ret = cia->cia_setkey(crypto_cipher_tfm(tfm), alignbuffer, keylen); - memset(alignbuffer, 0, keylen); - kfree(buffer); + kfree_sensitive(buffer); return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10 V2] sched/fair: Prefer physical cores when migrating tasks
by Cheng Yu 12 Aug '24

12 Aug '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAJEHU CVE: NA -------------------------------- When cpu hyperthreading is enabled, one physical core can virtualize multiple logical cpus. Assume that physical core0 virtualizes two logical cpus, cpu0 and cpu1. Only when the load of cpu0 exceeds the set ratio to the capacity of cpu0, the task will be migrated to the cpu1, otherwise the task will not be migrated and the cpu0 will still be used. External impacts: 1) default config in arm64,x86: CONFIG_SCHED_KEEP_ON_CORE=y 2) sysctl: /proc/sys/kernel/sched_util_ratio 3) sched features: KEEP_ON_CORE (default NO_KEEP_ON_CORE) Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + include/linux/sched/sysctl.h | 4 ++++ init/Kconfig | 12 ++++++++++ kernel/sched/fair.c | 31 ++++++++++++++++++++++++++ kernel/sched/features.h | 4 ++++ kernel/sysctl.c | 10 +++++++++ 6 files changed, 62 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 69ff0b64ba59..8c95a5332b40 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -189,6 +189,7 @@ CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y +CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index 5cd5b3c579d3..09214349bddf 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -35,6 +35,10 @@ extern unsigned int sysctl_sched_child_runs_first; extern int sysctl_sched_util_low_pct; #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +extern int sysctl_sched_util_ratio; +#endif + #ifdef CONFIG_QOS_SCHED_SMART_GRID extern unsigned int sysctl_smart_grid_strategy_ctrl; extern int sysctl_affinity_adjust_delay_ms; diff --git a/init/Kconfig b/init/Kconfig index e552194efbea..9dcc12704729 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1370,6 +1370,18 @@ config SCHED_STEAL If unsure, say N here. +config SCHED_KEEP_ON_CORE + bool "Prefer physical cores when migrating tasks" + depends on SCHED_SMT + default n + help + When cpu hyperthreading is enabled, one physical core can virtualize + multiple logical cpus. Assume that physical core0 virtualizes two + logical cpus, cpu0 and cpu1. Only when the load of cpu0 exceeds the + ratio to the capacity of cpu0, the task will be migrated to the cpu1, + otherwise the task will not be migrated and the cpu0 will still be + used. + config CHECKPOINT_RESTORE bool "Checkpoint/restore support" select PROC_CHILDREN diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 95d1841f8a20..8dc1d2afe1b7 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7242,6 +7242,20 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu return -1; } +#ifdef CONFIG_SCHED_KEEP_ON_CORE +int sysctl_sched_util_ratio = 100; + +static int core_has_spare(int cpu) +{ + int core_id = cpumask_first(cpu_smt_mask(cpu)); + struct rq *rq = cpu_rq(core_id); + unsigned long util = rq->cfs.avg.util_avg; + unsigned long capacity = rq->cpu_capacity; + + return util * 100 < capacity * sysctl_sched_util_ratio; +} +#endif + #else /* CONFIG_SCHED_SMT */ static inline void set_idle_cores(int cpu, int val) @@ -8210,6 +8224,14 @@ select_task_rq_fair(struct task_struct *p, int prev_cpu, int sd_flag, int wake_f } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (sched_feat(KEEP_ON_CORE) && + static_branch_likely(&sched_smt_present)) { + if (core_has_spare(new_cpu)) + new_cpu = cpumask_first(cpu_smt_mask((new_cpu))); + } +#endif + rcu_read_unlock(); #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY @@ -9701,6 +9723,15 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (sched_feat(KEEP_ON_CORE) && + static_branch_likely(&sched_smt_present)) { + if (core_has_spare(env->dst_cpu) && + cpumask_first(cpu_smt_mask((env->dst_cpu))) != env->dst_cpu) + return 0; + } +#endif + /* * We do not migrate tasks that are: * 1) throttled_lb_pair, or diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 76fade025c4b..fb885b20ba34 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -70,6 +70,10 @@ SCHED_FEAT(SIS_UTIL, false) SCHED_FEAT(STEAL, false) #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +SCHED_FEAT(KEEP_ON_CORE, false) +#endif + /* * Issue a WARN when we do multiple update_rq_clock() calls * in a single rq->lock section. Default disabled because the diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 3941856c19d1..bd7b17be9ba4 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2817,6 +2817,16 @@ static struct ctl_table kern_table[] = { .extra2 = &one_hundred, }, #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + { + .procname = "sched_util_ratio", + .data = &sysctl_sched_util_ratio, + .maxlen = sizeof(sysctl_sched_util_ratio), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + }, +#endif #ifdef CONFIG_QOS_SCHED_SMART_GRID { .procname = "smart_grid_strategy_ctrl", -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] orangefs: fix out-of-bounds fsid access
by Liu Shixin 12 Aug '24

12 Aug '24

From: Mike Marshall <hubcap(a)omnibond.com> stable inclusion from stable-v5.10.222 commit 1617249e24bd04c8047956afb43feec4876d1715 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPSE CVE: CVE-2024-42143 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53e4efa470d5fc6a96662d2d3322cfc925818517 ] Arnd Bergmann sent a patch to fsdevel, he says: "orangefs_statfs() copies two consecutive fields of the superblock into the statfs structure, which triggers a warning from the string fortification helpers" Jan Kara suggested an alternate way to do the patch to make it more readable. I ran both ideas through xfstests and both seem fine. This patch is based on Jan Kara's suggestion. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- fs/orangefs/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c index 2f2e430461b2..b48aef43b51d 100644 --- a/fs/orangefs/super.c +++ b/fs/orangefs/super.c @@ -200,7 +200,8 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf) (long)new_op->downcall.resp.statfs.files_avail); buf->f_type = sb->s_magic; - memcpy(&buf->f_fsid, &ORANGEFS_SB(sb)->fs_id, sizeof(buf->f_fsid)); + buf->f_fsid.val[0] = ORANGEFS_SB(sb)->fs_id; + buf->f_fsid.val[1] = ORANGEFS_SB(sb)->id; buf->f_bsize = new_op->downcall.resp.statfs.block_size; buf->f_namelen = ORANGEFS_NAME_MAX; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
by Liu Shixin 12 Aug '24

12 Aug '24

From: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> stable inclusion from stable-v5.10.221 commit cae52f61fda0f5d2949dc177f984c9e187d4c6a0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP0 CVE: CVE-2024-42087 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ee7860cd8b5763017f8dc785c2851fecb7a0c565 ] The ilitek-ili9881c controls the reset GPIO using the non-sleeping gpiod_set_value() function. This complains loudly when the GPIO controller needs to sleep. As the caller can sleep, use gpiod_set_value_cansleep() to fix the issue. Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://lore.kernel.org/r/20240317154839.21260-1-laurent.pinchart@ideasonbo… Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240317154839.21260-1-lauren… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c index 534dd7414d42..917cb322bab1 100644 --- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c +++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c @@ -506,10 +506,10 @@ static int ili9881c_prepare(struct drm_panel *panel) msleep(5); /* And reset it */ - gpiod_set_value(ctx->reset, 1); + gpiod_set_value_cansleep(ctx->reset, 1); msleep(20); - gpiod_set_value(ctx->reset, 0); + gpiod_set_value_cansleep(ctx->reset, 0); msleep(20); for (i = 0; i < ctx->desc->init_length; i++) { @@ -564,7 +564,7 @@ static int ili9881c_unprepare(struct drm_panel *panel) mipi_dsi_dcs_enter_sleep_mode(ctx->dsi); regulator_disable(ctx->power); - gpiod_set_value(ctx->reset, 1); + gpiod_set_value_cansleep(ctx->reset, 1); return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/i915/gt: Fix potential UAF by revoke of fence registers
by Liu Shixin 12 Aug '24

12 Aug '24

From: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> stable inclusion from stable-v5.10.221 commit f771b91f21c46ad1217328d05e72a2c7e3add535 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEOK CVE: CVE-2024-41092 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 996c3412a06578e9d779a16b9e79ace18125ab50 upstream. CI has been sporadically reporting the following issue triggered by igt@i915_selftest@live@hangcheck on ADL-P and similar machines: <6> [414.049203] i915: Running intel_hangcheck_live_selftests/igt_reset_evict_fence ... <6> [414.068804] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled <6> [414.068812] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled <3> [414.070354] Unable to pin Y-tiled fence; err:-4 <3> [414.071282] i915_vma_revoke_fence:301 GEM_BUG_ON(!i915_active_is_idle(&fence->active)) ... <4>[ 609.603992] ------------[ cut here ]------------ <2>[ 609.603995] kernel BUG at drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c:301! <4>[ 609.604003] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <4>[ 609.604006] CPU: 0 PID: 268 Comm: kworker/u64:3 Tainted: G U W 6.9.0-CI_DRM_14785-g1ba62f8cea9c+ #1 <4>[ 609.604008] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023 <4>[ 609.604010] Workqueue: i915 __i915_gem_free_work [i915] <4>[ 609.604149] RIP: 0010:i915_vma_revoke_fence+0x187/0x1f0 [i915] ... <4>[ 609.604271] Call Trace: <4>[ 609.604273] <TASK> ... <4>[ 609.604716] __i915_vma_evict+0x2e9/0x550 [i915] <4>[ 609.604852] __i915_vma_unbind+0x7c/0x160 [i915] <4>[ 609.604977] force_unbind+0x24/0xa0 [i915] <4>[ 609.605098] i915_vma_destroy+0x2f/0xa0 [i915] <4>[ 609.605210] __i915_gem_object_pages_fini+0x51/0x2f0 [i915] <4>[ 609.605330] __i915_gem_free_objects.isra.0+0x6a/0xc0 [i915] <4>[ 609.605440] process_scheduled_works+0x351/0x690 ... In the past, there were similar failures reported by CI from other IGT tests, observed on other platforms. Before commit 63baf4f3d587 ("drm/i915/gt: Only wait for GPU activity before unbinding a GGTT fence"), i915_vma_revoke_fence() was waiting for idleness of vma->active via fence_update(). That commit introduced vma->fence->active in order for the fence_update() to be able to wait selectively on that one instead of vma->active since only idleness of fence registers was needed. But then, another commit 0d86ee35097a ("drm/i915/gt: Make fence revocation unequivocal") replaced the call to fence_update() in i915_vma_revoke_fence() with only fence_write(), and also added that GEM_BUG_ON(!i915_active_is_idle(&fence->active)) in front. No justification was provided on why we might then expect idleness of vma->fence->active without first waiting on it. The issue can be potentially caused by a race among revocation of fence registers on one side and sequential execution of signal callbacks invoked on completion of a request that was using them on the other, still processed in parallel to revocation of those fence registers. Fix it by waiting for idleness of vma->fence->active in i915_vma_revoke_fence(). Fixes: 0d86ee35097a ("drm/i915/gt: Make fence revocation unequivocal") Closes: https://gitlab.freedesktop.org/drm/intel/issues/10021 Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Cc: stable(a)vger.kernel.org # v5.8+ Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240603195446.297690-2-janus… (cherry picked from commit 24bb052d3dd499c5956abad5f7d8e4fd07da7fb1) Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c index cd71631bef0c..ddf76a4e4fa2 100644 --- a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c +++ b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c @@ -309,6 +309,7 @@ void i915_vma_revoke_fence(struct i915_vma *vma) return; GEM_BUG_ON(fence->vma != vma); + i915_active_wait(&fence->active); GEM_BUG_ON(!i915_active_is_idle(&fence->active)); GEM_BUG_ON(atomic_read(&fence->pin_count)); -- 2.25.1

2 1

[PATCH OLK-5.10] orangefs: fix out-of-bounds fsid access
by Liu Shixin 12 Aug '24

12 Aug '24

From: Mike Marshall <hubcap(a)omnibond.com> stable inclusion from stable-v5.10.222 commit 1617249e24bd04c8047956afb43feec4876d1715 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPSE CVE: CVE-2024-42143 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53e4efa470d5fc6a96662d2d3322cfc925818517 ] Arnd Bergmann sent a patch to fsdevel, he says: "orangefs_statfs() copies two consecutive fields of the superblock into the statfs structure, which triggers a warning from the string fortification helpers" Jan Kara suggested an alternate way to do the patch to make it more readable. I ran both ideas through xfstests and both seem fine. This patch is based on Jan Kara's suggestion. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- fs/orangefs/super.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c index 2f2e430461b2..b48aef43b51d 100644 --- a/fs/orangefs/super.c +++ b/fs/orangefs/super.c @@ -200,7 +200,8 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf) (long)new_op->downcall.resp.statfs.files_avail); buf->f_type = sb->s_magic; - memcpy(&buf->f_fsid, &ORANGEFS_SB(sb)->fs_id, sizeof(buf->f_fsid)); + buf->f_fsid.val[0] = ORANGEFS_SB(sb)->fs_id; + buf->f_fsid.val[1] = ORANGEFS_SB(sb)->id; buf->f_bsize = new_op->downcall.resp.statfs.block_size; buf->f_namelen = ORANGEFS_NAME_MAX; -- 2.25.1

2 1

[PATCH OLK-5.10] drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
by Liu Shixin 12 Aug '24

12 Aug '24

From: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> stable inclusion from stable-v5.10.221 commit cae52f61fda0f5d2949dc177f984c9e187d4c6a0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP0 CVE: CVE-2024-42087 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ee7860cd8b5763017f8dc785c2851fecb7a0c565 ] The ilitek-ili9881c controls the reset GPIO using the non-sleeping gpiod_set_value() function. This complains loudly when the GPIO controller needs to sleep. As the caller can sleep, use gpiod_set_value_cansleep() to fix the issue. Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://lore.kernel.org/r/20240317154839.21260-1-laurent.pinchart@ideasonbo… Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240317154839.21260-1-lauren… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c index 534dd7414d42..917cb322bab1 100644 --- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c +++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c @@ -506,10 +506,10 @@ static int ili9881c_prepare(struct drm_panel *panel) msleep(5); /* And reset it */ - gpiod_set_value(ctx->reset, 1); + gpiod_set_value_cansleep(ctx->reset, 1); msleep(20); - gpiod_set_value(ctx->reset, 0); + gpiod_set_value_cansleep(ctx->reset, 0); msleep(20); for (i = 0; i < ctx->desc->init_length; i++) { @@ -564,7 +564,7 @@ static int ili9881c_unprepare(struct drm_panel *panel) mipi_dsi_dcs_enter_sleep_mode(ctx->dsi); regulator_disable(ctx->power); - gpiod_set_value(ctx->reset, 1); + gpiod_set_value_cansleep(ctx->reset, 1); return 0; } -- 2.25.1

2 1

[PATCH OLK-5.10] drm/i915/gt: Fix potential UAF by revoke of fence registers
by Liu Shixin 12 Aug '24

12 Aug '24

From: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> stable inclusion from stable-v5.10.221 commit f771b91f21c46ad1217328d05e72a2c7e3add535 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEOK CVE: CVE-2024-41092 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 996c3412a06578e9d779a16b9e79ace18125ab50 upstream. CI has been sporadically reporting the following issue triggered by igt@i915_selftest@live@hangcheck on ADL-P and similar machines: <6> [414.049203] i915: Running intel_hangcheck_live_selftests/igt_reset_evict_fence ... <6> [414.068804] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled <6> [414.068812] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled <3> [414.070354] Unable to pin Y-tiled fence; err:-4 <3> [414.071282] i915_vma_revoke_fence:301 GEM_BUG_ON(!i915_active_is_idle(&fence->active)) ... <4>[ 609.603992] ------------[ cut here ]------------ <2>[ 609.603995] kernel BUG at drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c:301! <4>[ 609.604003] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <4>[ 609.604006] CPU: 0 PID: 268 Comm: kworker/u64:3 Tainted: G U W 6.9.0-CI_DRM_14785-g1ba62f8cea9c+ #1 <4>[ 609.604008] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023 <4>[ 609.604010] Workqueue: i915 __i915_gem_free_work [i915] <4>[ 609.604149] RIP: 0010:i915_vma_revoke_fence+0x187/0x1f0 [i915] ... <4>[ 609.604271] Call Trace: <4>[ 609.604273] <TASK> ... <4>[ 609.604716] __i915_vma_evict+0x2e9/0x550 [i915] <4>[ 609.604852] __i915_vma_unbind+0x7c/0x160 [i915] <4>[ 609.604977] force_unbind+0x24/0xa0 [i915] <4>[ 609.605098] i915_vma_destroy+0x2f/0xa0 [i915] <4>[ 609.605210] __i915_gem_object_pages_fini+0x51/0x2f0 [i915] <4>[ 609.605330] __i915_gem_free_objects.isra.0+0x6a/0xc0 [i915] <4>[ 609.605440] process_scheduled_works+0x351/0x690 ... In the past, there were similar failures reported by CI from other IGT tests, observed on other platforms. Before commit 63baf4f3d587 ("drm/i915/gt: Only wait for GPU activity before unbinding a GGTT fence"), i915_vma_revoke_fence() was waiting for idleness of vma->active via fence_update(). That commit introduced vma->fence->active in order for the fence_update() to be able to wait selectively on that one instead of vma->active since only idleness of fence registers was needed. But then, another commit 0d86ee35097a ("drm/i915/gt: Make fence revocation unequivocal") replaced the call to fence_update() in i915_vma_revoke_fence() with only fence_write(), and also added that GEM_BUG_ON(!i915_active_is_idle(&fence->active)) in front. No justification was provided on why we might then expect idleness of vma->fence->active without first waiting on it. The issue can be potentially caused by a race among revocation of fence registers on one side and sequential execution of signal callbacks invoked on completion of a request that was using them on the other, still processed in parallel to revocation of those fence registers. Fix it by waiting for idleness of vma->fence->active in i915_vma_revoke_fence(). Fixes: 0d86ee35097a ("drm/i915/gt: Make fence revocation unequivocal") Closes: https://gitlab.freedesktop.org/drm/intel/issues/10021 Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Cc: stable(a)vger.kernel.org # v5.8+ Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240603195446.297690-2-janus… (cherry picked from commit 24bb052d3dd499c5956abad5f7d8e4fd07da7fb1) Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c index cd71631bef0c..ddf76a4e4fa2 100644 --- a/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c +++ b/drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c @@ -309,6 +309,7 @@ void i915_vma_revoke_fence(struct i915_vma *vma) return; GEM_BUG_ON(fence->vma != vma); + i915_active_wait(&fence->active); GEM_BUG_ON(!i915_active_is_idle(&fence->active)); GEM_BUG_ON(atomic_read(&fence->pin_count)); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] USB: serial: mos7840: fix crash on resume
by Yi Yang 12 Aug '24

12 Aug '24

From: Dmitry Smirnov <d.smirnov(a)inbox.lv> stable inclusion from stable-v5.10.222 commit 932a86a711c722b45ed47ba2103adca34d225b33 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILG4 CVE: CVE-2024-42244 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c15a688e49987385baa8804bf65d570e362f8576 upstream. Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic resume implementation when the driver has not provided one. This can trigger a crash on resume with mos7840 since support for multiple read URBs was added back in 2011. Specifically, both port read URBs are now submitted on resume for open ports, but the context pointer of the second URB is left set to the core rather than mos7840 port structure. Fix this by implementing dedicated suspend and resume functions for mos7840. Tested with Delock 87414 USB 2.0 to 4x serial adapter. Signed-off-by: Dmitry Smirnov <d.smirnov(a)inbox.lv> [ johan: analyse crash and rewrite commit message; set busy flag on resume; drop bulk-in check; drop unnecessary usb_kill_urb() ] Fixes: d83b405383c9 ("USB: serial: add support for multiple read urbs") Cc: stable(a)vger.kernel.org # 3.3 Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/usb/serial/mos7840.c | 45 ++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c index 48a9a0476a45..e568bf566ab0 100644 --- a/drivers/usb/serial/mos7840.c +++ b/drivers/usb/serial/mos7840.c @@ -1764,6 +1764,49 @@ static int mos7840_port_remove(struct usb_serial_port *port) return 0; } +static int mos7840_suspend(struct usb_serial *serial, pm_message_t message) +{ + struct moschip_port *mos7840_port; + struct usb_serial_port *port; + int i; + + for (i = 0; i < serial->num_ports; ++i) { + port = serial->port[i]; + if (!tty_port_initialized(&port->port)) + continue; + + mos7840_port = usb_get_serial_port_data(port); + + usb_kill_urb(mos7840_port->read_urb); + mos7840_port->read_urb_busy = false; + } + + return 0; +} + +static int mos7840_resume(struct usb_serial *serial) +{ + struct moschip_port *mos7840_port; + struct usb_serial_port *port; + int res; + int i; + + for (i = 0; i < serial->num_ports; ++i) { + port = serial->port[i]; + if (!tty_port_initialized(&port->port)) + continue; + + mos7840_port = usb_get_serial_port_data(port); + + mos7840_port->read_urb_busy = true; + res = usb_submit_urb(mos7840_port->read_urb, GFP_NOIO); + if (res) + mos7840_port->read_urb_busy = false; + } + + return 0; +} + static struct usb_serial_driver moschip7840_4port_device = { .driver = { .owner = THIS_MODULE, @@ -1792,6 +1835,8 @@ static struct usb_serial_driver moschip7840_4port_device = { .port_probe = mos7840_port_probe, .port_remove = mos7840_port_remove, .read_bulk_callback = mos7840_bulk_in_callback, + .suspend = mos7840_suspend, + .resume = mos7840_resume, }; static struct usb_serial_driver * const serial_drivers[] = { -- 2.25.1

2 1

[PATCH OLK-5.10] USB: serial: mos7840: fix crash on resume
by Yi Yang 12 Aug '24

12 Aug '24

From: Dmitry Smirnov <d.smirnov(a)inbox.lv> stable inclusion from stable-v5.10.222 commit 932a86a711c722b45ed47ba2103adca34d225b33 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILG4 CVE: CVE-2024-42244 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c15a688e49987385baa8804bf65d570e362f8576 upstream. Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic resume implementation when the driver has not provided one. This can trigger a crash on resume with mos7840 since support for multiple read URBs was added back in 2011. Specifically, both port read URBs are now submitted on resume for open ports, but the context pointer of the second URB is left set to the core rather than mos7840 port structure. Fix this by implementing dedicated suspend and resume functions for mos7840. Tested with Delock 87414 USB 2.0 to 4x serial adapter. Signed-off-by: Dmitry Smirnov <d.smirnov(a)inbox.lv> [ johan: analyse crash and rewrite commit message; set busy flag on resume; drop bulk-in check; drop unnecessary usb_kill_urb() ] Fixes: d83b405383c9 ("USB: serial: add support for multiple read urbs") Cc: stable(a)vger.kernel.org # 3.3 Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/usb/serial/mos7840.c | 45 ++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c index 48a9a0476a45..e568bf566ab0 100644 --- a/drivers/usb/serial/mos7840.c +++ b/drivers/usb/serial/mos7840.c @@ -1764,6 +1764,49 @@ static int mos7840_port_remove(struct usb_serial_port *port) return 0; } +static int mos7840_suspend(struct usb_serial *serial, pm_message_t message) +{ + struct moschip_port *mos7840_port; + struct usb_serial_port *port; + int i; + + for (i = 0; i < serial->num_ports; ++i) { + port = serial->port[i]; + if (!tty_port_initialized(&port->port)) + continue; + + mos7840_port = usb_get_serial_port_data(port); + + usb_kill_urb(mos7840_port->read_urb); + mos7840_port->read_urb_busy = false; + } + + return 0; +} + +static int mos7840_resume(struct usb_serial *serial) +{ + struct moschip_port *mos7840_port; + struct usb_serial_port *port; + int res; + int i; + + for (i = 0; i < serial->num_ports; ++i) { + port = serial->port[i]; + if (!tty_port_initialized(&port->port)) + continue; + + mos7840_port = usb_get_serial_port_data(port); + + mos7840_port->read_urb_busy = true; + res = usb_submit_urb(mos7840_port->read_urb, GFP_NOIO); + if (res) + mos7840_port->read_urb_busy = false; + } + + return 0; +} + static struct usb_serial_driver moschip7840_4port_device = { .driver = { .owner = THIS_MODULE, @@ -1792,6 +1835,8 @@ static struct usb_serial_driver moschip7840_4port_device = { .port_probe = mos7840_port_probe, .port_remove = mos7840_port_remove, .read_bulk_callback = mos7840_bulk_in_callback, + .suspend = mos7840_suspend, + .resume = mos7840_resume, }; static struct usb_serial_driver * const serial_drivers[] = { -- 2.25.1

2 1

[PATCH OLK-5.10 V1] sched/fair: Prefer physical cores when migrating tasks
by Cheng Yu 12 Aug '24

12 Aug '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAJEHU CVE: NA -------------------------------- When cpu hyperthreading is enabled, one physical core can virtualize multiple logical cpus. Assume that physical core0 virtualizes two logical cpus, cpu0 and cpu1. Only when the load of cpu0 exceeds the set threshold, the task will be migrated to the cpu1, otherwise the task will not be migrated and cpu0 will still be used. External impacts: 1) default config in arm64,x86: CONFIG_SCHED_KEEP_ON_CORE=y 2) sysctl: /proc/sys/kernel/sched_util_keep_on_core 3) sched features: KEEP_ON_CORE (default NO_KEEP_ON_CORE) Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/sched/sysctl.h | 4 +++ init/Kconfig | 11 ++++++++ kernel/sched/fair.c | 36 ++++++++++++++++++++++++++ kernel/sched/features.h | 4 +++ kernel/sysctl.c | 10 +++++++ 7 files changed, 67 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 69ff0b64ba59..8c95a5332b40 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -189,6 +189,7 @@ CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y +CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index f3b810d0cf47..65ef2f183b02 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -194,6 +194,7 @@ CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y +CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index 5cd5b3c579d3..fb1436286994 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -35,6 +35,10 @@ extern unsigned int sysctl_sched_child_runs_first; extern int sysctl_sched_util_low_pct; #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +extern int sysctl_sched_util_keep_on_core; +#endif + #ifdef CONFIG_QOS_SCHED_SMART_GRID extern unsigned int sysctl_smart_grid_strategy_ctrl; extern int sysctl_affinity_adjust_delay_ms; diff --git a/init/Kconfig b/init/Kconfig index e552194efbea..16a1d7ac726b 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1370,6 +1370,17 @@ config SCHED_STEAL If unsure, say N here. +config SCHED_KEEP_ON_CORE + bool "Prefer physical cores when migrating tasks" + depends on SMP + default n + help + When cpu hyperthreading is enabled, one physical core can virtualize + multiple logical cpus. Assume that physical core0 virtualizes two + logical cpus, cpu0 and cpu1. Only when the load of cpu0 exceeds the + set threshold, the task will be migrated to the cpu1, otherwise the + task will not be migrated and cpu0 will still be used. + config CHECKPOINT_RESTORE bool "Checkpoint/restore support" select PROC_CHILDREN diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 95d1841f8a20..4f3d81537bab 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -4497,6 +4497,12 @@ static inline void overload_clear(struct rq *rq) {} static inline void overload_set(struct rq *rq) {} #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +static int core_has_spare(int cpu); +#else +static inline int core_has_spare(int cpu) { return 0; } +#endif + #else /* CONFIG_SMP */ #define UPDATE_TG 0x0 @@ -4523,6 +4529,7 @@ static inline int newidle_balance(struct rq *rq, struct rq_flags *rf) static inline void rq_idle_stamp_update(struct rq *rq) {} static inline void rq_idle_stamp_clear(struct rq *rq) {} static inline int try_steal(struct rq *this_rq, struct rq_flags *rf) { return 0; } +static inline int core_has_spare(int cpu) { return 0; } static inline void overload_clear(struct rq *rq) {} static inline void overload_set(struct rq *rq) {} @@ -8210,6 +8217,13 @@ select_task_rq_fair(struct task_struct *p, int prev_cpu, int sd_flag, int wake_f } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (static_branch_likely(&sched_smt_present) && + sched_feat(KEEP_ON_CORE)) + if (core_has_spare(new_cpu)) + new_cpu = cpumask_first(cpu_smt_mask((new_cpu))); +#endif + rcu_read_unlock(); #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY @@ -9701,6 +9715,14 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (static_branch_likely(&sched_smt_present) && + sched_feat(KEEP_ON_CORE)) + if (core_has_spare(env->dst_cpu) && + cpumask_first(cpu_smt_mask((env->dst_cpu))) != env->dst_cpu) + return 0; +#endif + /* * We do not migrate tasks that are: * 1) throttled_lb_pair, or @@ -13189,6 +13211,20 @@ static int try_steal(struct rq *dst_rq, struct rq_flags *dst_rf) } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +int sysctl_sched_util_keep_on_core = 100; + +static int core_has_spare(int cpu) +{ + int core_id = cpumask_first(cpu_smt_mask(cpu)); + struct rq *rq = cpu_rq(core_id); + unsigned long util = rq->cfs.avg.util_avg; + unsigned long capacity = rq->cpu_capacity; + + return util * 100 < capacity * sysctl_sched_util_keep_on_core; +} +#endif + static void rq_online_fair(struct rq *rq) { update_sysctl(); diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 76fade025c4b..fb885b20ba34 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -70,6 +70,10 @@ SCHED_FEAT(SIS_UTIL, false) SCHED_FEAT(STEAL, false) #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +SCHED_FEAT(KEEP_ON_CORE, false) +#endif + /* * Issue a WARN when we do multiple update_rq_clock() calls * in a single rq->lock section. Default disabled because the diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 3941856c19d1..9abc01982645 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2817,6 +2817,16 @@ static struct ctl_table kern_table[] = { .extra2 = &one_hundred, }, #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + { + .procname = "sched_util_keep_on_core", + .data = &sysctl_sched_util_keep_on_core, + .maxlen = sizeof(sysctl_sched_util_keep_on_core), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + }, +#endif #ifdef CONFIG_QOS_SCHED_SMART_GRID { .procname = "smart_grid_strategy_ctrl", -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] USB: serial: mos7840: fix crash on resume
by Yi Yang 12 Aug '24

12 Aug '24

From: Dmitry Smirnov <d.smirnov(a)inbox.lv> stable inclusion from stable-v5.10.222 commit 932a86a711c722b45ed47ba2103adca34d225b33 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILG4 CVE: CVE-2024-42244 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c15a688e49987385baa8804bf65d570e362f8576 upstream. Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic resume implementation when the driver has not provided one. This can trigger a crash on resume with mos7840 since support for multiple read URBs was added back in 2011. Specifically, both port read URBs are now submitted on resume for open ports, but the context pointer of the second URB is left set to the core rather than mos7840 port structure. Fix this by implementing dedicated suspend and resume functions for mos7840. Tested with Delock 87414 USB 2.0 to 4x serial adapter. Signed-off-by: Dmitry Smirnov <d.smirnov(a)inbox.lv> [ johan: analyse crash and rewrite commit message; set busy flag on resume; drop bulk-in check; drop unnecessary usb_kill_urb() ] Fixes: d83b405383c9 ("USB: serial: add support for multiple read urbs") Cc: stable(a)vger.kernel.org # 3.3 Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/serial/mos7840.c [Context conflict] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/usb/serial/mos7840.c | 45 ++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c index 4a7bd26841af..1d391565dbc6 100644 --- a/drivers/usb/serial/mos7840.c +++ b/drivers/usb/serial/mos7840.c @@ -2364,6 +2364,49 @@ static int mos7840_port_remove(struct usb_serial_port *port) return 0; } +static int mos7840_suspend(struct usb_serial *serial, pm_message_t message) +{ + struct moschip_port *mos7840_port; + struct usb_serial_port *port; + int i; + + for (i = 0; i < serial->num_ports; ++i) { + port = serial->port[i]; + if (!tty_port_initialized(&port->port)) + continue; + + mos7840_port = usb_get_serial_port_data(port); + + usb_kill_urb(mos7840_port->read_urb); + mos7840_port->read_urb_busy = false; + } + + return 0; +} + +static int mos7840_resume(struct usb_serial *serial) +{ + struct moschip_port *mos7840_port; + struct usb_serial_port *port; + int res; + int i; + + for (i = 0; i < serial->num_ports; ++i) { + port = serial->port[i]; + if (!tty_port_initialized(&port->port)) + continue; + + mos7840_port = usb_get_serial_port_data(port); + + mos7840_port->read_urb_busy = true; + res = usb_submit_urb(mos7840_port->read_urb, GFP_NOIO); + if (res) + mos7840_port->read_urb_busy = false; + } + + return 0; +} + static struct usb_serial_driver moschip7840_4port_device = { .driver = { .owner = THIS_MODULE, @@ -2392,6 +2435,8 @@ static struct usb_serial_driver moschip7840_4port_device = { .port_remove = mos7840_port_remove, .read_bulk_callback = mos7840_bulk_in_callback, .read_int_callback = mos7840_interrupt_callback, + .suspend = mos7840_suspend, + .resume = mos7840_resume, }; static struct usb_serial_driver * const serial_drivers[] = { -- 2.25.1

2 1

[PATCH OLK-5.10 V1] sched/fair: Prefer physical cores when migrating tasks
by Cheng Yu 12 Aug '24

12 Aug '24

Only when the load of the physical core exceeds the set threshold, the task will be migrated, otherwise the task will keep on the physical core. External impacts: 1) default config in arm64,x86: CONFIG_SCHED_KEEP_ON_CORE=y 2) sysctl: /proc/sys/kernel/sched_util_keep_on_core 3) sched features: KEEP_ON_CORE (default NO_KEEP_ON_CORE) Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/sched/sysctl.h | 4 +++ init/Kconfig | 9 +++++++ kernel/sched/fair.c | 36 ++++++++++++++++++++++++++ kernel/sched/features.h | 4 +++ kernel/sysctl.c | 10 +++++++ 7 files changed, 65 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 69ff0b64ba59..8c95a5332b40 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -189,6 +189,7 @@ CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y +CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index f3b810d0cf47..65ef2f183b02 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -194,6 +194,7 @@ CONFIG_USER_NS=y CONFIG_PID_NS=y CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y +CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y # CONFIG_SYSFS_DEPRECATED is not set diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index 5cd5b3c579d3..fb1436286994 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -35,6 +35,10 @@ extern unsigned int sysctl_sched_child_runs_first; extern int sysctl_sched_util_low_pct; #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +extern int sysctl_sched_util_keep_on_core; +#endif + #ifdef CONFIG_QOS_SCHED_SMART_GRID extern unsigned int sysctl_smart_grid_strategy_ctrl; extern int sysctl_affinity_adjust_delay_ms; diff --git a/init/Kconfig b/init/Kconfig index e552194efbea..ee94515b2f04 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1370,6 +1370,15 @@ config SCHED_STEAL If unsure, say N here. +config SCHED_KEEP_ON_CORE + bool "Prefer physical cores when migrating tasks" + depends on SMP + default n + help + Only when the load of the physical core exceeds the set threshold, + the task will be migrated, otherwise the task will keep on the + physical core. + config CHECKPOINT_RESTORE bool "Checkpoint/restore support" select PROC_CHILDREN diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 95d1841f8a20..4f3d81537bab 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -4497,6 +4497,12 @@ static inline void overload_clear(struct rq *rq) {} static inline void overload_set(struct rq *rq) {} #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +static int core_has_spare(int cpu); +#else +static inline int core_has_spare(int cpu) { return 0; } +#endif + #else /* CONFIG_SMP */ #define UPDATE_TG 0x0 @@ -4523,6 +4529,7 @@ static inline int newidle_balance(struct rq *rq, struct rq_flags *rf) static inline void rq_idle_stamp_update(struct rq *rq) {} static inline void rq_idle_stamp_clear(struct rq *rq) {} static inline int try_steal(struct rq *this_rq, struct rq_flags *rf) { return 0; } +static inline int core_has_spare(int cpu) { return 0; } static inline void overload_clear(struct rq *rq) {} static inline void overload_set(struct rq *rq) {} @@ -8210,6 +8217,13 @@ select_task_rq_fair(struct task_struct *p, int prev_cpu, int sd_flag, int wake_f } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (static_branch_likely(&sched_smt_present) && + sched_feat(KEEP_ON_CORE)) + if (core_has_spare(new_cpu)) + new_cpu = cpumask_first(cpu_smt_mask((new_cpu))); +#endif + rcu_read_unlock(); #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY @@ -9701,6 +9715,14 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (static_branch_likely(&sched_smt_present) && + sched_feat(KEEP_ON_CORE)) + if (core_has_spare(env->dst_cpu) && + cpumask_first(cpu_smt_mask((env->dst_cpu))) != env->dst_cpu) + return 0; +#endif + /* * We do not migrate tasks that are: * 1) throttled_lb_pair, or @@ -13189,6 +13211,20 @@ static int try_steal(struct rq *dst_rq, struct rq_flags *dst_rf) } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +int sysctl_sched_util_keep_on_core = 100; + +static int core_has_spare(int cpu) +{ + int core_id = cpumask_first(cpu_smt_mask(cpu)); + struct rq *rq = cpu_rq(core_id); + unsigned long util = rq->cfs.avg.util_avg; + unsigned long capacity = rq->cpu_capacity; + + return util * 100 < capacity * sysctl_sched_util_keep_on_core; +} +#endif + static void rq_online_fair(struct rq *rq) { update_sysctl(); diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 76fade025c4b..fb885b20ba34 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -70,6 +70,10 @@ SCHED_FEAT(SIS_UTIL, false) SCHED_FEAT(STEAL, false) #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +SCHED_FEAT(KEEP_ON_CORE, false) +#endif + /* * Issue a WARN when we do multiple update_rq_clock() calls * in a single rq->lock section. Default disabled because the diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 3941856c19d1..9abc01982645 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -2817,6 +2817,16 @@ static struct ctl_table kern_table[] = { .extra2 = &one_hundred, }, #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + { + .procname = "sched_util_keep_on_core", + .data = &sysctl_sched_util_keep_on_core, + .maxlen = sizeof(sysctl_sched_util_keep_on_core), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + }, +#endif #ifdef CONFIG_QOS_SCHED_SMART_GRID { .procname = "smart_grid_strategy_ctrl", -- 2.25.1

2 1

[PATCH OLK-5.10 v2] net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
by Liu Jian 12 Aug '24

12 Aug '24

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v6.10 commit 626dfed5fa3bfb41e0dffd796032b555b69f9cde category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILGI CVE: CVE-2024-42246 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to loop forever, filling up the syslog and causing the kernel to potentially freeze up. Neil suggested: This will propagate -EPERM up into other layers which might not be ready to handle it. It might be safer to map EPERM to an error we would be more likely to expect from the network system - such as ECONNREFUSED or ENETDOWN. ECONNREFUSED as error seems reasonable. For programs setting a different error can be out of reach (see handling in 4fbac77d2d09) in particular on kernels which do not have f10d05966196 ("bpf: Make BPF_PROG_RUN_ARRAY return -err instead of allow boolean"), thus given that it is better to simply remap for consistent behavior. UDP does handle EPERM in xs_udp_send_request(). Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect") Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind") Co-developed-by: Lex Siegel <usiegl00(a)gmail.com> Signed-off-by: Lex Siegel <usiegl00(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: Neil Brown <neilb(a)suse.de> Cc: Trond Myklebust <trondmy(a)kernel.org> Cc: Anna Schumaker <anna(a)kernel.org> Link: https://github.com/cilium/cilium/issues/33395 Link: https://lore.kernel.org/bpf/171374175513.12877.8993642908082014881@noble.ne… Link: https://patch.msgid.link/9069ec1d59e4b2129fc23433349fd5580ad43921.172007507… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/sunrpc/xprtsock.c [Did not backport 280254b605ff ("SUNRPC: Clean up xs_tcp_setup_sock()").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sunrpc/xprtsock.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 31b1ab97140b..134a90b2216c 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -2337,6 +2337,13 @@ static void xs_tcp_setup_socket(struct work_struct *work) case -EALREADY: xprt_unlock_connect(xprt, transport); return; + case -EPERM: + /* Happens, for instance, if a BPF program is preventing + * the connect. Remap the error so upper layers can better + * deal with it. + */ + status = -ECONNREFUSED; + fallthrough; case -EINVAL: /* Happens, for instance, if the user specified a link * local IPv6 address without a scope-id. -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
by Liu Jian 12 Aug '24

12 Aug '24

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v6.10 commit 626dfed5fa3bfb41e0dffd796032b555b69f9cde category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILGI CVE: CVE-2024-42246 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to loop forever, filling up the syslog and causing the kernel to potentially freeze up. Neil suggested: This will propagate -EPERM up into other layers which might not be ready to handle it. It might be safer to map EPERM to an error we would be more likely to expect from the network system - such as ECONNREFUSED or ENETDOWN. ECONNREFUSED as error seems reasonable. For programs setting a different error can be out of reach (see handling in 4fbac77d2d09) in particular on kernels which do not have f10d05966196 ("bpf: Make BPF_PROG_RUN_ARRAY return -err instead of allow boolean"), thus given that it is better to simply remap for consistent behavior. UDP does handle EPERM in xs_udp_send_request(). Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect") Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind") Co-developed-by: Lex Siegel <usiegl00(a)gmail.com> Signed-off-by: Lex Siegel <usiegl00(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: Neil Brown <neilb(a)suse.de> Cc: Trond Myklebust <trondmy(a)kernel.org> Cc: Anna Schumaker <anna(a)kernel.org> Link: https://github.com/cilium/cilium/issues/33395 Link: https://lore.kernel.org/bpf/171374175513.12877.8993642908082014881@noble.ne… Link: https://patch.msgid.link/9069ec1d59e4b2129fc23433349fd5580ad43921.172007507… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/sunrpc/xprtsock.c [Did not backport 280254b605ff ("SUNRPC: Clean up xs_tcp_setup_sock()").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sunrpc/xprtsock.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 31b1ab97140b..134a90b2216c 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -2337,6 +2337,13 @@ static void xs_tcp_setup_socket(struct work_struct *work) case -EALREADY: xprt_unlock_connect(xprt, transport); return; + case -EPERM: + /* Happens, for instance, if a BPF program is preventing + * the connect. Remap the error so upper layers can better + * deal with it. + */ + status = -ECONNREFUSED; + fallthrough; case -EINVAL: /* Happens, for instance, if the user specified a link * local IPv6 address without a scope-id. -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 7838/23480] drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.o: warning: objtool: nvkm_mmu_oneinit()+0x7b2: unreachable instruction
by kernel test robot 10 Aug '24

10 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 1ee05443d1dbf5cf95dcc762bb2baa828e2ccbcc commit: d4bdc26bcd632cee393b5171345d5fa6293fe42b [7838/23480] include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures config: x86_64-randconfig-161-20240810 (https://download.01.org/0day-ci/archive/20240810/202408101202.aWgNk9Gj-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240810/202408101202.aWgNk9Gj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408101202.aWgNk9Gj-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c:65:1: warning: no previous prototype for function 'nvkm_mmu_ptp_get' [-Wmissing-prototypes] 65 | nvkm_mmu_ptp_get(struct nvkm_mmu *mmu, u32 size, bool zero) | ^ drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c:64:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 64 | struct nvkm_mmu_pt * | ^ | static 1 warning generated. >> drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.o: warning: objtool: nvkm_mmu_oneinit()+0x7b2: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 1ee05443d1dbf5cf95dcc762bb2baa828e2ccbcc
by kernel test robot 10 Aug '24

10 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 1ee05443d1dbf5cf95dcc762bb2baa828e2ccbcc !10825 Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" elapsed time: 725m configs tested: 31 configs skipped: 111 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240810 gcc-14.1.0 arm64 randconfig-002-20240810 gcc-14.1.0 arm64 randconfig-003-20240810 gcc-14.1.0 arm64 randconfig-004-20240810 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240810 gcc-12 x86_64 buildonly-randconfig-002-20240810 clang-18 x86_64 buildonly-randconfig-003-20240810 clang-18 x86_64 buildonly-randconfig-004-20240810 clang-18 x86_64 buildonly-randconfig-005-20240810 clang-18 x86_64 buildonly-randconfig-006-20240810 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240810 clang-18 x86_64 randconfig-002-20240810 clang-18 x86_64 randconfig-003-20240810 gcc-12 x86_64 randconfig-004-20240810 clang-18 x86_64 randconfig-005-20240810 clang-18 x86_64 randconfig-006-20240810 gcc-12 x86_64 randconfig-011-20240810 clang-18 x86_64 randconfig-012-20240810 gcc-12 x86_64 randconfig-013-20240810 clang-18 x86_64 randconfig-014-20240810 clang-18 x86_64 randconfig-015-20240810 clang-18 x86_64 randconfig-016-20240810 clang-18 x86_64 randconfig-071-20240810 clang-18 x86_64 randconfig-072-20240810 gcc-12 x86_64 randconfig-073-20240810 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION b863a7488a15e24e9caf81b204af36cf7ae75ebc
by kernel test robot 10 Aug '24

10 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b863a7488a15e24e9caf81b204af36cf7ae75ebc !10796 Revert "ARM: spectre-v2: turn off the mitigation via boot cmdline param" Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-randconfig-001-20240809 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- x86_64-allyesconfig | `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device |-- x86_64-buildonly-randconfig-002-20240810 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-003-20240810 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-005-20240810 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus `-- x86_64-randconfig-004-20240810 `-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:error:no-member-named-physfn-in-struct-pci_dev elapsed time: 723m configs tested: 35 configs skipped: 107 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240809 clang-20 arm64 randconfig-002-20240809 clang-15 arm64 randconfig-003-20240809 clang-15 arm64 randconfig-004-20240809 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240809 gcc-14.1.0 loongarch randconfig-002-20240809 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240810 gcc-12 x86_64 buildonly-randconfig-002-20240810 clang-18 x86_64 buildonly-randconfig-003-20240810 clang-18 x86_64 buildonly-randconfig-004-20240810 clang-18 x86_64 buildonly-randconfig-005-20240810 clang-18 x86_64 buildonly-randconfig-006-20240810 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240810 clang-18 x86_64 randconfig-002-20240810 clang-18 x86_64 randconfig-003-20240810 gcc-12 x86_64 randconfig-004-20240810 clang-18 x86_64 randconfig-005-20240810 clang-18 x86_64 randconfig-006-20240810 gcc-12 x86_64 randconfig-011-20240810 clang-18 x86_64 randconfig-012-20240810 gcc-12 x86_64 randconfig-013-20240810 clang-18 x86_64 randconfig-014-20240810 clang-18 x86_64 randconfig-015-20240810 clang-18 x86_64 randconfig-016-20240810 clang-18 x86_64 randconfig-071-20240810 clang-18 x86_64 randconfig-072-20240810 gcc-12 x86_64 randconfig-073-20240810 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] Revert "NFS: Don't interrupt file writeout due to fatal errors"
by Li Lingfeng 09 Aug '24

09 Aug '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAJ2ZJ -------------------------------- This reverts commit 812ffba3b83c86bba38fd087fa41fe2f08f7acb6. Commit 812ffba3b83c ("NFS: Don't interrupt file writeout due to fatal errors") tries to keep writing back when hit fatal errors. However, since page->mapping will be set as NULL in nfs_write_error_remove_page() and it will be used in nfs_create_request(), null-ptr-deref will be triggered if we don't stop it immediately. Fixes: 812ffba3b83c ("NFS: Don't interrupt file writeout due to fatal errors") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/write.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfs/write.c b/fs/nfs/write.c index e4b1ce488637..706ed79e23e2 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -662,7 +662,7 @@ static int nfs_page_async_flush(struct nfs_pageio_descriptor *pgio, return ret; out_launder: nfs_write_error_remove_page(req); - return 0; + return ret; } static int nfs_do_writepage(struct page *page, struct writeback_control *wbc, -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v3] ext4: flexibly control whether to enable dioread_nolock by default
by Yang Erkun 09 Aug '24

09 Aug '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAAPPE -------------------------------- After commit 244adf6426ee ("ext4: make dioread_nolock the default"), writeback for ext4 mounted with dioread_nolock will first start journal, then get a unwritten extent, change i_size and mark inode dirty. Besides, we won't call ext4_jbd2_inode_add_write since the extent is unwritten, so when jbd2 try do commit journal, we will not wait stable data. And combine with a poweroff before data writepage success, we will find a file with size has already been update but the content still keep zero since the extent is unwritten. This is really intolerable for some production. So we need give a choice to decided does we really need default enable dioread_nolock. Back to why we default enable dioread_nolock, the upper commit give some description, the most import problem is that dioread parallel with fault write(and writepage for fault write has alloc the block) will read some stale data. But the case dioread parallel with fault write is really rarely used, so it seems little impact now. We now give a more flexible way to control how to default enable dioread_nolock or not: - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to N, still default enable dioread_nlock - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to Y, default disable dioread_nolock, also we give a module param default_dioread_nolock to control it, it you want default enable dioread_nlock, set default_dioread_nolock to 1. Fixes: 244adf6426ee ("ext4: make dioread_nolock the default") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/ext4/Kconfig | 8 ++++++++ fs/ext4/super.c | 19 +++++++++++++++++++ 4 files changed, 29 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 86f6cfaafa85..2d6b37def3fb 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6207,6 +6207,7 @@ CONFIG_EXT4_USE_FOR_EXT2=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set +# CONFIG_EXT4_DIOREAD_NOLOCK_PARAM is not set CONFIG_JBD2=m # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=m diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 686e5cdfc801..27b1f9def28d 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7292,6 +7292,7 @@ CONFIG_EXT4_USE_FOR_EXT2=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set +# CONFIG_EXT4_DIOREAD_NOLOCK_PARAM is not set CONFIG_JBD2=m # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=m diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig index 86699c8cab28..72913ea5343f 100644 --- a/fs/ext4/Kconfig +++ b/fs/ext4/Kconfig @@ -117,3 +117,11 @@ config EXT4_KUNIT_TESTS to the KUnit documentation in Documentation/dev-tools/kunit/. If unsure, say N. + +config EXT4_DIOREAD_NOLOCK_PARAM + bool "Ext4 default_dioread_nolock module param support" + depends on EXT4_FS + default n + help + Support to enable default_dioread_nolock module param, be attention to + that we default disable dioread_nolock with this config set to Y. diff --git a/fs/ext4/super.c b/fs/ext4/super.c index ac032f517a60..5dbe420487e4 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -62,6 +62,20 @@ #define CREATE_TRACE_POINTS #include <trace/events/ext4.h> +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM +/* + * After 244adf6426ee ("ext4: make dioread_nolock the default"), we will enable + * dioread_nolock by default, but this options may lead data lose combine with + * poweroff(Since we may first update i_size, and then unwritten extent convert + * to written extent). For this case, we give a param to help control does we + * really default enable dioread_nolock and we default disable dioread_nolock, + * enable it with ext4.default_dioread_nolock=1 if you want. + */ +int default_dioread_nolock; +module_param_named(default_dioread_nolock, default_dioread_nolock, int, 0644); +MODULE_PARM_DESC(default_dioread_nolock, "Default enable dioread_nolock"); +#endif + static struct ext4_lazy_init *ext4_li_info; static struct mutex ext4_li_mtx; static struct ratelimit_state ext4_mount_msg_ratelimit; @@ -4272,8 +4286,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) blocksize = EXT4_MIN_BLOCK_SIZE << le32_to_cpu(es->s_log_block_size); +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM + if (blocksize == PAGE_SIZE && default_dioread_nolock) + set_opt(sb, DIOREAD_NOLOCK); +#else if (blocksize == PAGE_SIZE) set_opt(sb, DIOREAD_NOLOCK); +#endif if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; -- 2.39.2

2 1

[PATCH OLK-6.6 v2] ext4: flexibly control whether to enable dioread_nolock by default
by Yang Erkun 09 Aug '24

09 Aug '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAAPPE -------------------------------- After commit 244adf6426ee ("ext4: make dioread_nolock the default"), writeback for ext4 mounted with dioread_nolock will first start journal, then get a unwritten extent, change i_size and mark inode dirty. Besides, we won't call ext4_jbd2_inode_add_write since the extent is unwritten, so when jbd2 try do commit journal, we will not wait stable data. And combine with a poweroff before data writepage success, we will find a file with size has already been update but the content still keep zero since the extent is unwritten. This is really intolerable for some production. So we need give a choice to decided does we really need default enable dioread_nolock. Back to why we default enable dioread_nolock, the upper commit give some description, the most import problem is that dioread parallel with fault write(and writepage for fault write has alloc the block) will read some stale data. But the case dioread parallel with fault write is really rarely used, so it seems little impact now. We now give a more flexible way to control how to default enable dioread_nolock or not: - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to N, still default enable dioread_nlock - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to Y, default disable dioread_nolock, also we give a module param default_dioread_nolock to control it, it you want default enable dioread_nlock, set default_dioread_nolock to 1. Fixes: 244adf6426ee ("ext4: make dioread_nolock the default") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/ext4/Kconfig | 8 ++++++++ fs/ext4/super.c | 19 +++++++++++++++++++ 4 files changed, 29 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 072d26fcc238..650fe88cbb04 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6954,6 +6954,7 @@ CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set CONFIG_EXT4_ERROR_REPORT=y +# CONFIG_EXT4_DIOREAD_NOLOCK_PARAM is not set CONFIG_JBD2=m # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=m diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index f86f22d8b397..b3403ba040bf 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -8117,6 +8117,7 @@ CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set CONFIG_EXT4_ERROR_REPORT=y +# CONFIG_EXT4_DIOREAD_NOLOCK_PARAM is not set CONFIG_JBD2=m # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=m diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig index 3b095c5aa1d3..68270899fc81 100644 --- a/fs/ext4/Kconfig +++ b/fs/ext4/Kconfig @@ -126,3 +126,11 @@ config EXT4_ERROR_REPORT help Implement the ext3/ext4 file system error report. Report error to userspace by netlink + +config EXT4_DIOREAD_NOLOCK_PARAM + bool "Ext4 default_dioread_nolock module param support" + depends on EXT4_FS + default n + help + Support to enable default_dioread_nolock module param, be attention to + that we default disable dioread_nolock with this config set to Y. diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 0ef4b804e18e..9f3c7855095d 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -66,6 +66,20 @@ #define CREATE_TRACE_POINTS #include <trace/events/ext4.h> +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM +/* + * After 244adf6426ee ("ext4: make dioread_nolock the default"), we will enable + * dioread_nolock by default, but this options may lead data lose combine with + * poweroff(Since we may first update i_size, and then unwritten extent convert + * to written extent). For this case, we give a param to help control does we + * really default enable dioread_nolock and we default disable dioread_nolock, + * enable it with ext4.default_dioread_nolock=1 if you want. + */ +int default_dioread_nolock; +module_param_named(default_dioread_nolock, default_dioread_nolock, int, 0644); +MODULE_PARM_DESC(default_dioread_nolock, "Default enable dioread_nolock"); +#endif + static struct ext4_lazy_init *ext4_li_info; static DEFINE_MUTEX(ext4_li_mtx); static struct ratelimit_state ext4_mount_msg_ratelimit; @@ -4472,8 +4486,13 @@ static void ext4_set_def_opts(struct super_block *sb, ((def_mount_opts & EXT4_DEFM_NODELALLOC) == 0)) set_opt(sb, DELALLOC); +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM + if (sb->s_blocksize == PAGE_SIZE && default_dioread_nolock) + set_opt(sb, DIOREAD_NOLOCK); +#else if (sb->s_blocksize == PAGE_SIZE) set_opt(sb, DIOREAD_NOLOCK); +#endif /* Use iomap for buffered IO path on 4k pagesize */ if (PAGE_SIZE == SZ_4K) -- 2.39.2

2 1

[PATCH OLK-5.10 v2] ext4: flexibly control whether to enable dioread_nolock by default
by Yang Erkun 09 Aug '24

09 Aug '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAAPPE -------------------------------- After commit 244adf6426ee ("ext4: make dioread_nolock the default"), writeback for ext4 mounted with dioread_nolock will first start journal, then get a unwritten extent, change i_size and mark inode dirty. Besides, we won't call ext4_jbd2_inode_add_write since the extent is unwritten, so when jbd2 try do commit journal, we will not wait stable data. And combine with a poweroff before data writepage success, we will find a file with size has already been update but the content still keep zero since the extent is unwritten. This is really intolerable for some production. So we need give a choice to decided does we really need default enable dioread_nolock. Back to why we default enable dioread_nolock, the upper commit give some description, the most import problem is that dioread parallel with fault write(and writepage for fault write has alloc the block) will read some stale data. But the case dioread parallel with fault write is really rarely used, so it seems little impact now. We now give a more flexible way to control how to default enable dioread_nolock or not: - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to N, still default enable dioread_nlock - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to Y, default disable dioread_nolock, also we give a module param default_dioread_nolock to control it, it you want default enable dioread_nlock, set default_dioread_nolock to 1. Fixes: 244adf6426ee ("ext4: make dioread_nolock the default") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/ext4/Kconfig | 8 ++++++++ fs/ext4/super.c | 19 +++++++++++++++++++ 4 files changed, 29 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 69ff0b64ba59..553dfbac6e4d 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6326,6 +6326,7 @@ CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set CONFIG_EXT4_ERROR_REPORT=y CONFIG_EXT4_MITIGATION_FALSE_SHARING=y +# CONFIG_EXT4_DIOREAD_NOLOCK_PARAM is not set CONFIG_JBD2=m # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=m diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index f3b810d0cf47..9f07c24ea89d 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7384,6 +7384,7 @@ CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set CONFIG_EXT4_ERROR_REPORT=y CONFIG_EXT4_MITIGATION_FALSE_SHARING=y +# CONFIG_EXT4_DIOREAD_NOLOCK_PARAM is not set CONFIG_JBD2=m # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=m diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig index cd7f1e90c237..2e1a5b0796ed 100644 --- a/fs/ext4/Kconfig +++ b/fs/ext4/Kconfig @@ -134,3 +134,11 @@ config EXT4_MITIGATION_FALSE_SHARING Enable this to mitigation cacheline false sharing in ext4 inode info. If unsure, say N. + +config EXT4_DIOREAD_NOLOCK_PARAM + bool "Ext4 default_dioread_nolock module param support" + depends on EXT4_FS + default n + help + Support to enable default_dioread_nolock module param, be attention to + that we default disable dioread_nolock with this config set to Y. diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 90f886184fc6..db64771c6e46 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -64,6 +64,20 @@ #define CREATE_TRACE_POINTS #include <trace/events/ext4.h> +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM +/* + * After 244adf6426ee ("ext4: make dioread_nolock the default"), we will enable + * dioread_nolock by default, but this options may lead data lose combine with + * poweroff(Since we may first update i_size, and then unwritten extent convert + * to written extent). For this case, we give a param to help control does we + * really default enable dioread_nolock and we default disable dioread_nolock, + * enable it with ext4.default_dioread_nolock=1 if you want. + */ +int default_dioread_nolock; +module_param_named(default_dioread_nolock, default_dioread_nolock, int, 0644); +MODULE_PARM_DESC(default_dioread_nolock, "Default enable dioread_nolock"); +#endif + static struct ext4_lazy_init *ext4_li_info; static struct mutex ext4_li_mtx; static struct ratelimit_state ext4_mount_msg_ratelimit; @@ -4292,8 +4306,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) blocksize = EXT4_MIN_BLOCK_SIZE << le32_to_cpu(es->s_log_block_size); +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM + if (blocksize == PAGE_SIZE && default_dioread_nolock) + set_opt(sb, DIOREAD_NOLOCK); +#else if (blocksize == PAGE_SIZE) set_opt(sb, DIOREAD_NOLOCK); +#endif if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] ext4: flexibly control whether to enable dioread_nolock by default
by Yang Erkun 09 Aug '24

09 Aug '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAAPPE -------------------------------- After commit 244adf6426ee ("ext4: make dioread_nolock the default"), writeback for ext4 mounted with dioread_nolock will first start journal, then get a unwritten extent, change i_size and mark inode dirty. Besides, we won't call ext4_jbd2_inode_add_write since the extent is unwritten, so when jbd2 try do commit journal, we will not wait stable data. And combine with a poweroff before data writepage success, we will find a file with size has already been update but the content still keep zero since the extent is unwritten. This is really intolerable for some production. So we need give a choice to decided does we really need default enable dioread_nolock. Back to why we default enable dioread_nolock, the upper commit give some description, the most import problem is that dioread parallel with fault write(and writepage for fault write has alloc the block) will read some stale data. But the case dioread parallel with fault write is really rarely used, so it seems little impact now. We now give a more flexible way to control how to default enable dioread_nolock or not: - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to N, still default enable dioread_nlock - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to Y, default disable dioread_nolock, also we give a module param default_dioread_nolock to control it, it you want default enable dioread_nlock, set default_dioread_nolock to 1. Fixes: 244adf6426ee ("ext4: make dioread_nolock the default") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/ext4/Kconfig | 8 ++++++++ fs/ext4/super.c | 19 +++++++++++++++++++ 4 files changed, 29 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 072d26fcc238..650fe88cbb04 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6954,6 +6954,7 @@ CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set CONFIG_EXT4_ERROR_REPORT=y +# CONFIG_EXT4_DIOREAD_NOLOCK_PARAM is not set CONFIG_JBD2=m # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=m diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index f86f22d8b397..b3403ba040bf 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -8117,6 +8117,7 @@ CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y # CONFIG_EXT4_DEBUG is not set CONFIG_EXT4_ERROR_REPORT=y +# CONFIG_EXT4_DIOREAD_NOLOCK_PARAM is not set CONFIG_JBD2=m # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=m diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig index 3b095c5aa1d3..68270899fc81 100644 --- a/fs/ext4/Kconfig +++ b/fs/ext4/Kconfig @@ -126,3 +126,11 @@ config EXT4_ERROR_REPORT help Implement the ext3/ext4 file system error report. Report error to userspace by netlink + +config EXT4_DIOREAD_NOLOCK_PARAM + bool "Ext4 default_dioread_nolock module param support" + depends on EXT4_FS + default n + help + Support to enable default_dioread_nolock module param, be attention to + that we default disable dioread_nolock with this config set to Y. diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 0ef4b804e18e..9f3c7855095d 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -66,6 +66,20 @@ #define CREATE_TRACE_POINTS #include <trace/events/ext4.h> +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM +/* + * After 244adf6426ee ("ext4: make dioread_nolock the default"), we will enable + * dioread_nolock by default, but this options may lead data lose combine with + * poweroff(Since we may first update i_size, and then unwritten extent convert + * to written extent). For this case, we give a param to help control does we + * really default enable dioread_nolock and we default disable dioread_nolock, + * enable it with ext4.default_dioread_nolock=1 if you want. + */ +int default_dioread_nolock; +module_param_named(default_dioread_nolock, default_dioread_nolock, int, 0644); +MODULE_PARM_DESC(default_dioread_nolock, "Default enable dioread_nolock"); +#endif + static struct ext4_lazy_init *ext4_li_info; static DEFINE_MUTEX(ext4_li_mtx); static struct ratelimit_state ext4_mount_msg_ratelimit; @@ -4472,8 +4486,13 @@ static void ext4_set_def_opts(struct super_block *sb, ((def_mount_opts & EXT4_DEFM_NODELALLOC) == 0)) set_opt(sb, DELALLOC); +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM + if (sb->s_blocksize == PAGE_SIZE && default_dioread_nolock) + set_opt(sb, DIOREAD_NOLOCK); +#else if (sb->s_blocksize == PAGE_SIZE) set_opt(sb, DIOREAD_NOLOCK); +#endif /* Use iomap for buffered IO path on 4k pagesize */ if (PAGE_SIZE == SZ_4K) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v4] powerpc/pseries: Whitelist dtl slub object for copying to userspace
by zhangyinhua 09 Aug '24

09 Aug '24

From: Anjali K <anjalik(a)linux.ibm.com> stable inclusion from stable-v5.10.223 commit 6b16098148ea58a67430d90e20476be2377c3acd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELM CVE: CVE-2024-41065 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------------------------------------- [ Upstream commit 1a14150e1656f7a332a943154fc486504db4d586 ] Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as shown below. kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85 Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries NIP: c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8 REGS: c000000120c078c0 TRAP: 0700 Not tainted (6.10.0-rc3) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 2828220f XER: 0000000e CFAR: c0000000001fdc80 IRQMASK: 0 [ ... GPRs omitted ... ] NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0 LR [c0000000005d23d0] usercopy_abort+0x74/0xb0 Call Trace: usercopy_abort+0x74/0xb0 (unreliable) __check_heap_object+0xf8/0x120 check_heap_object+0x218/0x240 __check_object_size+0x84/0x1a4 dtl_file_read+0x17c/0x2c4 full_proxy_read+0x8c/0x110 vfs_read+0xdc/0x3a0 ksys_read+0x84/0x144 system_call_exception+0x124/0x330 system_call_vectored_common+0x15c/0x2ec --- interrupt: 3000 at 0x7fff81f3ab34 Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") requires that only whitelisted areas in slab/slub objects can be copied to userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. Dtl contains hypervisor dispatch events which are expected to be read by privileged users. Hence mark this safe for user access. Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the entire object. Co-developed-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Anjali K <anjalik(a)linux.ibm.com> Reviewed-by: Srikar Dronamraju <srikar(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240614173844.746818-1-anjalik@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/powerpc/platforms/pseries/setup.c [Resolve conflicts due to lack of d5394c059da9786043934bed474562cde124e7d3] Signed-off-by: zhangyinhua <zhangyinhua4(a)h-partners.com> --- arch/powerpc/platforms/pseries/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c index 2e0d38cafdd4..35ec6ed65bd1 100644 --- a/arch/powerpc/platforms/pseries/setup.c +++ b/arch/powerpc/platforms/pseries/setup.c @@ -309,8 +309,8 @@ static inline int alloc_dispatch_logs(void) static int alloc_dispatch_log_kmem_cache(void) { - dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES, - DISPATCH_LOG_BYTES, 0, NULL); + dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES, + DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, NULL); if (!dtl_cache) { pr_warn("Failed to create dispatch trace log buffer cache\n"); pr_warn("Stolen time statistics will be unreliable\n"); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
by Liu Jian 09 Aug '24

09 Aug '24

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-6.10 commit 626dfed5fa3bfb41e0dffd796032b555b69f9cde category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILGI CVE: CVE-2024-42246 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to loop forever, filling up the syslog and causing the kernel to potentially freeze up. Neil suggested: This will propagate -EPERM up into other layers which might not be ready to handle it. It might be safer to map EPERM to an error we would be more likely to expect from the network system - such as ECONNREFUSED or ENETDOWN. ECONNREFUSED as error seems reasonable. For programs setting a different error can be out of reach (see handling in 4fbac77d2d09) in particular on kernels which do not have f10d05966196 ("bpf: Make BPF_PROG_RUN_ARRAY return -err instead of allow boolean"), thus given that it is better to simply remap for consistent behavior. UDP does handle EPERM in xs_udp_send_request(). Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect") Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind") Co-developed-by: Lex Siegel <usiegl00(a)gmail.com> Signed-off-by: Lex Siegel <usiegl00(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: Neil Brown <neilb(a)suse.de> Cc: Trond Myklebust <trondmy(a)kernel.org> Cc: Anna Schumaker <anna(a)kernel.org> Link: https://github.com/cilium/cilium/issues/33395 Link: https://lore.kernel.org/bpf/171374175513.12877.8993642908082014881@noble.ne… Link: https://patch.msgid.link/9069ec1d59e4b2129fc23433349fd5580ad43921.172007507… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/sunrpc/xprtsock.c [Did not backport 280254b605ff ("SUNRPC: Clean up xs_tcp_setup_sock()").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sunrpc/xprtsock.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 31b1ab97140b..134a90b2216c 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -2337,6 +2337,13 @@ static void xs_tcp_setup_socket(struct work_struct *work) case -EALREADY: xprt_unlock_connect(xprt, transport); return; + case -EPERM: + /* Happens, for instance, if a BPF program is preventing + * the connect. Remap the error so upper layers can better + * deal with it. + */ + status = -ECONNREFUSED; + fallthrough; case -EINVAL: /* Happens, for instance, if the user specified a link * local IPv6 address without a scope-id. -- 2.34.1

2 1

[PATCH OLK-5.10] net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
by Liu Jian 09 Aug '24

09 Aug '24

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-6.10 commit 626dfed5fa3bfb41e0dffd796032b555b69f9cde category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILGI CVE: CVE-2024-42246 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to loop forever, filling up the syslog and causing the kernel to potentially freeze up. Neil suggested: This will propagate -EPERM up into other layers which might not be ready to handle it. It might be safer to map EPERM to an error we would be more likely to expect from the network system - such as ECONNREFUSED or ENETDOWN. ECONNREFUSED as error seems reasonable. For programs setting a different error can be out of reach (see handling in 4fbac77d2d09) in particular on kernels which do not have f10d05966196 ("bpf: Make BPF_PROG_RUN_ARRAY return -err instead of allow boolean"), thus given that it is better to simply remap for consistent behavior. UDP does handle EPERM in xs_udp_send_request(). Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect") Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind") Co-developed-by: Lex Siegel <usiegl00(a)gmail.com> Signed-off-by: Lex Siegel <usiegl00(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: Neil Brown <neilb(a)suse.de> Cc: Trond Myklebust <trondmy(a)kernel.org> Cc: Anna Schumaker <anna(a)kernel.org> Link: https://github.com/cilium/cilium/issues/33395 Link: https://lore.kernel.org/bpf/171374175513.12877.8993642908082014881@noble.ne… Link: https://patch.msgid.link/9069ec1d59e4b2129fc23433349fd5580ad43921.172007507… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/sunrpc/xprtsock.c [Did not backport 280254b605ff ("SUNRPC: Clean up xs_tcp_setup_sock()").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sunrpc/xprtsock.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 31b1ab97140b..134a90b2216c 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -2337,6 +2337,13 @@ static void xs_tcp_setup_socket(struct work_struct *work) case -EALREADY: xprt_unlock_connect(xprt, transport); return; + case -EPERM: + /* Happens, for instance, if a BPF program is preventing + * the connect. Remap the error so upper layers can better + * deal with it. + */ + status = -ECONNREFUSED; + fallthrough; case -EINVAL: /* Happens, for instance, if the user specified a link * local IPv6 address without a scope-id. -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-36971
by Liu Jian 09 Aug '24

09 Aug '24

CVE-2024-36971 Eric Dumazet (1): net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 3 ++- include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 31 insertions(+), 47 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] ext4: flexibly control whether to enable dioread_nolock by default
by Yang Erkun 09 Aug '24

09 Aug '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAAPPE -------------------------------- After commit 244adf6426ee ("ext4: make dioread_nolock the default"), writeback for ext4 mounted with dioread_nolock will first start journal, then get a unwritten extent, change i_size and mark inode dirty. Besides, we won't call ext4_jbd2_inode_add_write since the extent is unwritten, so when jbd2 try do commit journal, we will not wait stable data. And combine with a poweroff before data writepage success, we will find a file with size has already been update but the content still keep zero since the extent is unwritten. This is really intolerable for some production. So we need give a choice to decided does we really need default enable dioread_nolock. Back to why we default enable dioread_nolock, the upper commit give some description, the most import problem is that dioread parallel with fault write(and writepage for fault write has alloc the block) will read some stale data. But the case dioread parallel with fault write is really rarely used, so it seems little impact now. We now give a more flexible way to control how to default enable dioread_nolock or not: - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to N, still default enable dioread_nlock - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to Y, default disable dioread_nolock, also we give a module param default_dioread_nolock to control it, it you want default enable dioread_nlock, set default_dioread_nolock to 1. Fixes: 244adf6426ee ("ext4: make dioread_nolock the default") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/ext4/Kconfig | 8 ++++++++ fs/ext4/super.c | 19 +++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig index 3b095c5aa1d3..68270899fc81 100644 --- a/fs/ext4/Kconfig +++ b/fs/ext4/Kconfig @@ -126,3 +126,11 @@ config EXT4_ERROR_REPORT help Implement the ext3/ext4 file system error report. Report error to userspace by netlink + +config EXT4_DIOREAD_NOLOCK_PARAM + bool "Ext4 default_dioread_nolock module param support" + depends on EXT4_FS + default n + help + Support to enable default_dioread_nolock module param, be attention to + that we default disable dioread_nolock with this config set to Y. diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 0ef4b804e18e..9f3c7855095d 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -66,6 +66,20 @@ #define CREATE_TRACE_POINTS #include <trace/events/ext4.h> +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM +/* + * After 244adf6426ee ("ext4: make dioread_nolock the default"), we will enable + * dioread_nolock by default, but this options may lead data lose combine with + * poweroff(Since we may first update i_size, and then unwritten extent convert + * to written extent). For this case, we give a param to help control does we + * really default enable dioread_nolock and we default disable dioread_nolock, + * enable it with ext4.default_dioread_nolock=1 if you want. + */ +int default_dioread_nolock; +module_param_named(default_dioread_nolock, default_dioread_nolock, int, 0644); +MODULE_PARM_DESC(default_dioread_nolock, "Default enable dioread_nolock"); +#endif + static struct ext4_lazy_init *ext4_li_info; static DEFINE_MUTEX(ext4_li_mtx); static struct ratelimit_state ext4_mount_msg_ratelimit; @@ -4472,8 +4486,13 @@ static void ext4_set_def_opts(struct super_block *sb, ((def_mount_opts & EXT4_DEFM_NODELALLOC) == 0)) set_opt(sb, DELALLOC); +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM + if (sb->s_blocksize == PAGE_SIZE && default_dioread_nolock) + set_opt(sb, DIOREAD_NOLOCK); +#else if (sb->s_blocksize == PAGE_SIZE) set_opt(sb, DIOREAD_NOLOCK); +#endif /* Use iomap for buffered IO path on 4k pagesize */ if (PAGE_SIZE == SZ_4K) -- 2.39.2

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 456b68d77a204440e8cad893401b03f0cdfde785
by kernel test robot 09 Aug '24

09 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 456b68d77a204440e8cad893401b03f0cdfde785 !10836 wifi: mt76: replace skb_put with skb_put_zero elapsed time: 743m configs tested: 34 configs skipped: 111 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240809 clang-20 arm64 randconfig-002-20240809 clang-15 arm64 randconfig-003-20240809 clang-15 arm64 randconfig-004-20240809 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240809 clang-18 x86_64 buildonly-randconfig-002-20240809 gcc-12 x86_64 buildonly-randconfig-003-20240809 gcc-12 x86_64 buildonly-randconfig-004-20240809 clang-18 x86_64 buildonly-randconfig-005-20240809 clang-18 x86_64 buildonly-randconfig-006-20240809 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240809 gcc-12 x86_64 randconfig-002-20240809 gcc-12 x86_64 randconfig-003-20240809 gcc-12 x86_64 randconfig-004-20240809 clang-18 x86_64 randconfig-005-20240809 clang-18 x86_64 randconfig-006-20240809 gcc-12 x86_64 randconfig-011-20240809 clang-18 x86_64 randconfig-012-20240809 gcc-12 x86_64 randconfig-013-20240809 clang-18 x86_64 randconfig-014-20240809 clang-18 x86_64 randconfig-015-20240809 clang-18 x86_64 randconfig-016-20240809 gcc-12 x86_64 randconfig-071-20240809 clang-18 x86_64 randconfig-072-20240809 clang-18 x86_64 randconfig-073-20240809 gcc-12 x86_64 randconfig-074-20240809 clang-18 x86_64 randconfig-075-20240809 clang-18 x86_64 randconfig-076-20240809 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] ext4: flexibly control whether to enable dioread_nolock by default
by Yang Erkun 09 Aug '24

09 Aug '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAAPPE -------------------------------- After commit 244adf6426ee ("ext4: make dioread_nolock the default"), writeback for ext4 mounted with dioread_nolock will first start journal, then get a unwritten extent, change i_size and mark inode dirty. Besides, we won't call ext4_jbd2_inode_add_write since the extent is unwritten, so when jbd2 try do commit journal, we will not wait stable data. And combine with a poweroff before data writepage success, we will find a file with size has already been update but the content still keep zero since the extent is unwritten. This is really intolerable for some production. So we need give a choice to decided does we really need default enable dioread_nolock. Back to why we default enable dioread_nolock, the upper commit give some description, the most import problem is that dioread parallel with fault write(and writepage for fault write has alloc the block) will read some stale data. But the case dioread parallel with fault write is really rarely used, so it seems little impact now. We now give a more flexible way to control how to default enable dioread_nolock or not: - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to N, still default enable dioread_nlock - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to Y, default disable dioread_nolock, also we give a module param default_dioread_nolock to control it, it you want default enable dioread_nlock, set default_dioread_nolock to 1. Fixes: 244adf6426ee ("ext4: make dioread_nolock the default") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/ext4/Kconfig | 8 ++++++++ fs/ext4/super.c | 19 +++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig index 86699c8cab28..72913ea5343f 100644 --- a/fs/ext4/Kconfig +++ b/fs/ext4/Kconfig @@ -117,3 +117,11 @@ config EXT4_KUNIT_TESTS to the KUnit documentation in Documentation/dev-tools/kunit/. If unsure, say N. + +config EXT4_DIOREAD_NOLOCK_PARAM + bool "Ext4 default_dioread_nolock module param support" + depends on EXT4_FS + default n + help + Support to enable default_dioread_nolock module param, be attention to + that we default disable dioread_nolock with this config set to Y. diff --git a/fs/ext4/super.c b/fs/ext4/super.c index ac032f517a60..5dbe420487e4 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -62,6 +62,20 @@ #define CREATE_TRACE_POINTS #include <trace/events/ext4.h> +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM +/* + * After 244adf6426ee ("ext4: make dioread_nolock the default"), we will enable + * dioread_nolock by default, but this options may lead data lose combine with + * poweroff(Since we may first update i_size, and then unwritten extent convert + * to written extent). For this case, we give a param to help control does we + * really default enable dioread_nolock and we default disable dioread_nolock, + * enable it with ext4.default_dioread_nolock=1 if you want. + */ +int default_dioread_nolock; +module_param_named(default_dioread_nolock, default_dioread_nolock, int, 0644); +MODULE_PARM_DESC(default_dioread_nolock, "Default enable dioread_nolock"); +#endif + static struct ext4_lazy_init *ext4_li_info; static struct mutex ext4_li_mtx; static struct ratelimit_state ext4_mount_msg_ratelimit; @@ -4272,8 +4286,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) blocksize = EXT4_MIN_BLOCK_SIZE << le32_to_cpu(es->s_log_block_size); +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM + if (blocksize == PAGE_SIZE && default_dioread_nolock) + set_opt(sb, DIOREAD_NOLOCK); +#else if (blocksize == PAGE_SIZE) set_opt(sb, DIOREAD_NOLOCK); +#endif if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; -- 2.39.2

2 1

[PATCH OLK-5.10] ext4: flexibly control whether to enable dioread_nolock by default
by Yang Erkun 09 Aug '24

09 Aug '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAAPPE -------------------------------- After commit 244adf6426ee ("ext4: make dioread_nolock the default"), writeback for ext4 mounted with dioread_nolock will first start journal, then get a unwritten extent, change i_size and mark inode dirty. Besides, we won't call ext4_jbd2_inode_add_write since the extent is unwritten, so when jbd2 try do commit journal, we will not wait stable data. And combine with a poweroff before data writepage success, we will find a file with size has already been update but the content still keep zero since the extent is unwritten. This is really intolerable for some production. So we need give a choice to decided does we really need default enable dioread_nolock. Back to why we default enable dioread_nolock, the upper commit give some description, the most import problem is that dioread parallel with fault write(and writepage for fault write has alloc the block) will read some stale data. But the case dioread parallel with fault write is really rarely used, so it seems little impact now. We now give a more flexible way to control how to default enable dioread_nolock or not: - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to N, still default enable dioread_nlock - set CONFIG_EXT4_DIOREAD_NOLOCK_PARAM to Y, default disable dioread_nolock, also we give a module param default_dioread_nolock to control it, it you want default enable dioread_nlock, set default_dioread_nolock to 1. Fixes: 244adf6426ee ("ext4: make dioread_nolock the default") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/ext4/Kconfig | 8 ++++++++ fs/ext4/super.c | 19 +++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig index cd7f1e90c237..2e1a5b0796ed 100644 --- a/fs/ext4/Kconfig +++ b/fs/ext4/Kconfig @@ -134,3 +134,11 @@ config EXT4_MITIGATION_FALSE_SHARING Enable this to mitigation cacheline false sharing in ext4 inode info. If unsure, say N. + +config EXT4_DIOREAD_NOLOCK_PARAM + bool "Ext4 default_dioread_nolock module param support" + depends on EXT4_FS + default n + help + Support to enable default_dioread_nolock module param, be attention to + that we default disable dioread_nolock with this config set to Y. diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 90f886184fc6..db64771c6e46 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -64,6 +64,20 @@ #define CREATE_TRACE_POINTS #include <trace/events/ext4.h> +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM +/* + * After 244adf6426ee ("ext4: make dioread_nolock the default"), we will enable + * dioread_nolock by default, but this options may lead data lose combine with + * poweroff(Since we may first update i_size, and then unwritten extent convert + * to written extent). For this case, we give a param to help control does we + * really default enable dioread_nolock and we default disable dioread_nolock, + * enable it with ext4.default_dioread_nolock=1 if you want. + */ +int default_dioread_nolock; +module_param_named(default_dioread_nolock, default_dioread_nolock, int, 0644); +MODULE_PARM_DESC(default_dioread_nolock, "Default enable dioread_nolock"); +#endif + static struct ext4_lazy_init *ext4_li_info; static struct mutex ext4_li_mtx; static struct ratelimit_state ext4_mount_msg_ratelimit; @@ -4292,8 +4306,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) blocksize = EXT4_MIN_BLOCK_SIZE << le32_to_cpu(es->s_log_block_size); +#ifdef CONFIG_EXT4_DIOREAD_NOLOCK_PARAM + if (blocksize == PAGE_SIZE && default_dioread_nolock) + set_opt(sb, DIOREAD_NOLOCK); +#else if (blocksize == PAGE_SIZE) set_opt(sb, DIOREAD_NOLOCK); +#endif if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) { sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] wireguard: allowedips: avoid unaligned 64-bit memory accesses
by Zhengchao Shao 09 Aug '24

09 Aug '24

From: Helge Deller <deller(a)kernel.org> stable inclusion from stable-v5.10.222 commit ae630de24efb123d7199a43256396d7758f4cb75 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILG8 CVE: CVE-2024-42247 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit 948f991c62a4018fb81d85804eeab3029c6209f8 upstream. On the parisc platform, the kernel issues kernel warnings because swap_endian() tries to load a 128-bit IPv6 address from an unaligned memory location: Kernel: unaligned access to 0x55f4688c in wg_allowedips_insert_v6+0x2c/0x80 [wireguard] (iir 0xf3010df) Kernel: unaligned access to 0x55f46884 in wg_allowedips_insert_v6+0x38/0x80 [wireguard] (iir 0xf2010dc) Avoid such unaligned memory accesses by instead using the get_unaligned_be64() helper macro. Signed-off-by: Helge Deller <deller(a)gmx.de> [Jason: replace src[8] in original patch with src+8] Cc: stable(a)vger.kernel.org Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com> Link: https://patch.msgid.link/20240704154517.1572127-3-Jason@zx2c4.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/wireguard/allowedips.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireguard/allowedips.c b/drivers/net/wireguard/allowedips.c index 5bf7822c53f1..04d7047167d0 100644 --- a/drivers/net/wireguard/allowedips.c +++ b/drivers/net/wireguard/allowedips.c @@ -15,8 +15,8 @@ static void swap_endian(u8 *dst, const u8 *src, u8 bits) if (bits == 32) { *(u32 *)dst = be32_to_cpu(*(const __be32 *)src); } else if (bits == 128) { - ((u64 *)dst)[0] = be64_to_cpu(((const __be64 *)src)[0]); - ((u64 *)dst)[1] = be64_to_cpu(((const __be64 *)src)[1]); + ((u64 *)dst)[0] = get_unaligned_be64(src); + ((u64 *)dst)[1] = get_unaligned_be64(src + 8); } } -- 2.34.1

2 1

[PATCH OLK-5.10] wireguard: allowedips: avoid unaligned 64-bit memory accesses
by Zhengchao Shao 09 Aug '24

09 Aug '24

From: Helge Deller <deller(a)kernel.org> stable inclusion from stable-v5.10.222 commit ae630de24efb123d7199a43256396d7758f4cb75 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILG8 CVE: CVE-2024-42247 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit 948f991c62a4018fb81d85804eeab3029c6209f8 upstream. On the parisc platform, the kernel issues kernel warnings because swap_endian() tries to load a 128-bit IPv6 address from an unaligned memory location: Kernel: unaligned access to 0x55f4688c in wg_allowedips_insert_v6+0x2c/0x80 [wireguard] (iir 0xf3010df) Kernel: unaligned access to 0x55f46884 in wg_allowedips_insert_v6+0x38/0x80 [wireguard] (iir 0xf2010dc) Avoid such unaligned memory accesses by instead using the get_unaligned_be64() helper macro. Signed-off-by: Helge Deller <deller(a)gmx.de> [Jason: replace src[8] in original patch with src+8] Cc: stable(a)vger.kernel.org Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com> Link: https://patch.msgid.link/20240704154517.1572127-3-Jason@zx2c4.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/wireguard/allowedips.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireguard/allowedips.c b/drivers/net/wireguard/allowedips.c index 0ba714ca5185..4b8528206cc8 100644 --- a/drivers/net/wireguard/allowedips.c +++ b/drivers/net/wireguard/allowedips.c @@ -15,8 +15,8 @@ static void swap_endian(u8 *dst, const u8 *src, u8 bits) if (bits == 32) { *(u32 *)dst = be32_to_cpu(*(const __be32 *)src); } else if (bits == 128) { - ((u64 *)dst)[0] = be64_to_cpu(((const __be64 *)src)[0]); - ((u64 *)dst)[1] = be64_to_cpu(((const __be64 *)src)[1]); + ((u64 *)dst)[0] = get_unaligned_be64(src); + ((u64 *)dst)[1] = get_unaligned_be64(src + 8); } } -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD SUCCESS dc3e480568627c27f13878766588cc8c32213af5
by kernel test robot 09 Aug '24

09 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: dc3e480568627c27f13878766588cc8c32213af5 !10816 sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- arm64-randconfig-051-20240808 | |-- arch-arm64-boot-dts-freescale-imx8mp-beacon-kit.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-beacon-kit.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-beacon-kit.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-beacon-kit.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-data-modul-edm-sbc.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-data-modul-edm-sbc.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-data-modul-edm-sbc.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-data-modul-edm-sbc.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-debix-model-a.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-debix-model-a.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-debix-model-a.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-debix-model-a.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-debix-som-a-bmb-.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-debix-som-a-bmb-.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-debix-som-a-bmb-.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-debix-som-a-bmb-.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-dhcom-pdk2.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-dhcom-pdk2.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-dhcom-pdk2.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-dhcom-pdk2.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-dhcom-pdk3.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-dhcom-pdk3.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-dhcom-pdk3.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-dhcom-pdk3.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-evk.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-evk.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-evk.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-evk.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-icore-mx8mp-edimm2..dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-icore-mx8mp-edimm2..dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-icore-mx8mp-edimm2..dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-icore-mx8mp-edimm2..dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-msc-sm2s-ep1.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-msc-sm2s-ep1.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-msc-sm2s-ep1.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-msc-sm2s-ep1.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-phyboard-pollux-rdk.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-phyboard-pollux-rdk.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-phyboard-pollux-rdk.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-phyboard-pollux-rdk.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw71xx-2x.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw71xx-2x.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw71xx-2x.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw71xx-2x.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw72xx-2x.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw72xx-2x.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw72xx-2x.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw72xx-2x.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw73xx-2x.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw73xx-2x.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw73xx-2x.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw73xx-2x.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw74xx.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw74xx.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw74xx.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw74xx.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw7905-2x.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw7905-2x.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw7905-2x.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-venice-gw7905-2x.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-dahlia.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-dahlia.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-dahlia.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-dahlia.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-dev.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-dev.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-dev.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-dev.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-yavia.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-yavia.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-yavia.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-nonwifi-yavia.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-dahlia.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-dahlia.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-dahlia.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-dahlia.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-dev.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-dev.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-dev.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-dev.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-yavia.dtb:blk-ctrl-32fc0000:clock-names:apb-axi-ref_266m-ref_24m-fdcc-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-yavia.dtb:blk-ctrl-32fc0000:clocks:is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-yavia.dtb:blk-ctrl-32fc0000:power-domain-names:bus-irqsteer-lcdif-pai-pvi-trng-hdmi-tx-hdmi-tx-phy-hdcp-hrv-is-too-long | |-- arch-arm64-boot-dts-freescale-imx8mp-verdin-wifi-yavia.dtb:blk-ctrl-32fc0000:power-domains:is-too-long | |-- arch-arm64-boot-dts-qcom-sa8775p-ride.dtb:ethernet:Unevaluated-properties-are-not-allowed-(-dma-coherent-mdio-phy-handle-phy-mode-power-domains-rx-fifo-depth-rx-queues-config-snps-mtl-rx-config-snps-m | `-- arch-arm64-boot-dts-qcom-sa8775p-ride.dtb:ethernet:Unevaluated-properties-are-not-allowed-(-dma-coherent-phy-handle-phy-mode-power-domains-rx-fifo-depth-rx-queues-config-snps-mtl-rx-config-snps-mtl-tx |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-randconfig-001-20240809 | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- x86_64-allyesconfig `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device elapsed time: 731m configs tested: 14 configs skipped: 124 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240809 clang-20 arm64 randconfig-002-20240809 clang-15 arm64 randconfig-003-20240809 clang-15 arm64 randconfig-004-20240809 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240809 gcc-14.1.0 loongarch randconfig-002-20240809 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 defconfig gcc-11 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH 1/4] RDMA/hns: Register notifier block of bonding events in bond_grp
by Chengchang Tang 08 Aug '24

08 Aug '24

From: Junxian Huang <huangjunxian6(a)hisilicon.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAH10J ---------------------------------------------------------------------- Currently the notifier block of bonding events is in the hr_dev structure. bond_grp is dynamic allocated in the event handler. Since all these hr_dev would response bonding events, we had to add complicated filter to choose a suitable hr_dev to handle the events. Besides we also had to concern about the validity of bond_grp pointers in many concurrency cases as they may have been freed. Refactor the bonding event handler by: 1. allocating/deallocating bond_grp structures when driver inits/exits; 2. registering notifier block of bonding events in bond_grp Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_bond.c | 415 +++++++++++--------- drivers/infiniband/hw/hns/hns_roce_bond.h | 3 + drivers/infiniband/hw/hns/hns_roce_device.h | 1 - drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 9 +- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 5 files changed, 247 insertions(+), 183 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_bond.c b/drivers/infiniband/hw/hns/hns_roce_bond.c index 4b2b5538c918..c5b30d7dab67 100644 --- a/drivers/infiniband/hw/hns/hns_roce_bond.c +++ b/drivers/infiniband/hw/hns/hns_roce_bond.c @@ -52,32 +52,6 @@ static int get_netdev_bond_slave_id(struct net_device *net_dev, return -ENOENT; } -static bool is_hrdev_bond_slave(struct hns_roce_dev *hr_dev, - struct net_device *upper_dev) -{ - struct hns_roce_bond_group *bond_grp; - struct net_device *net_dev; - u8 bus_num; - - if (!hr_dev || !upper_dev) - return false; - - if (!netif_is_lag_master(upper_dev)) - return false; - - net_dev = get_hr_netdev(hr_dev, 0); - bus_num = get_hr_bus_num(hr_dev); - - if (upper_dev == get_upper_dev_from_ndev(net_dev)) - return true; - - bond_grp = hns_roce_get_bond_grp(net_dev, bus_num); - if (bond_grp && upper_dev == bond_grp->upper_dev) - return true; - - return false; -} - struct hns_roce_bond_group *hns_roce_get_bond_grp(struct net_device *net_dev, u8 bus_num) { @@ -92,8 +66,10 @@ struct hns_roce_bond_group *hns_roce_get_bond_grp(struct net_device *net_dev, bond_grp = die_info->bgrps[i]; if (!bond_grp) continue; - if (get_netdev_bond_slave_id(net_dev, bond_grp) >= 0 || - (bond_grp->upper_dev == get_upper_dev_from_ndev(net_dev))) + if (get_netdev_bond_slave_id(net_dev, bond_grp) >= 0) + return bond_grp; + if (bond_grp->upper_dev && + bond_grp->upper_dev == get_upper_dev_from_ndev(net_dev)) return bond_grp; } @@ -107,8 +83,8 @@ bool hns_roce_bond_is_active(struct hns_roce_dev *hr_dev) u8 bus_num = get_hr_bus_num(hr_dev); bond_grp = hns_roce_get_bond_grp(net_dev, bus_num); - - if (bond_grp && bond_grp->bond_state != HNS_ROCE_BOND_NOT_BONDED) + if (bond_grp && bond_grp->bond_state != HNS_ROCE_BOND_NOT_BONDED && + bond_grp->bond_state != HNS_ROCE_BOND_NOT_ATTACHED) return true; return false; @@ -507,39 +483,6 @@ static void hns_roce_do_bond_work(struct work_struct *work) hns_roce_queue_bond_work(bond_grp, HZ); } -int hns_roce_bond_init(struct hns_roce_dev *hr_dev) -{ - struct net_device *net_dev = get_hr_netdev(hr_dev, 0); - struct hns_roce_v2_priv *priv = hr_dev->priv; - struct hns_roce_bond_group *bond_grp; - u8 bus_num = get_hr_bus_num(hr_dev); - int ret; - - bond_grp = hns_roce_get_bond_grp(net_dev, bus_num); - if (priv->handle->rinfo.reset_state == HNS_ROCE_STATE_RST_INIT && - bond_grp) { - bond_grp->main_hr_dev = hr_dev; - ret = hns_roce_recover_bond(bond_grp); - if (ret) { - ibdev_err(&hr_dev->ib_dev, - "failed to recover RoCE bond, ret = %d.\n", - ret); - return ret; - } - } - - hr_dev->bond_nb.notifier_call = hns_roce_bond_event; - ret = register_netdevice_notifier(&hr_dev->bond_nb); - if (ret) { - ibdev_err(&hr_dev->ib_dev, - "failed to register notifier for RoCE bond, ret = %d.\n", - ret); - hr_dev->bond_nb.notifier_call = NULL; - } - - return ret; -} - static struct hns_roce_die_info *alloc_die_info(int bus_num) { struct hns_roce_die_info *die_info; @@ -611,67 +554,116 @@ static int remove_bond_id(int bus_num, u8 bond_id) return 0; } -int hns_roce_cleanup_bond(struct hns_roce_bond_group *bond_grp) +static int hns_roce_alloc_bond_grp(struct hns_roce_dev *hr_dev) { - bool completion_no_waiter; + struct hns_roce_bond_group *bgrps[ROCE_BOND_NUM_MAX]; + struct hns_roce_bond_group *bond_grp; int ret; + int i; - ret = bond_grp->main_hr_dev ? - hns_roce_cmd_bond(bond_grp, HNS_ROCE_CLEAR_BOND) : -EIO; - if (ret) - BOND_ERR_LOG("failed to clear RoCE bond, ret = %d.\n", ret); - - cancel_delayed_work(&bond_grp->bond_work); - ret = remove_bond_id(bond_grp->bus_num, bond_grp->bond_id); - if (ret) - BOND_ERR_LOG("failed to remove bond id %u, ret = %d.\n", - bond_grp->bond_id, ret); + for (i = 0; i < ROCE_BOND_NUM_MAX; i++) { + bond_grp = kvzalloc(sizeof(*bond_grp), GFP_KERNEL); + if (!bond_grp) { + ret = -ENOMEM; + goto mem_err; + } - completion_no_waiter = completion_done(&bond_grp->bond_work_done); - complete(&bond_grp->bond_work_done); - mutex_destroy(&bond_grp->bond_mutex); - if (completion_no_waiter) - kfree(bond_grp); + mutex_init(&bond_grp->bond_mutex); + INIT_DELAYED_WORK(&bond_grp->bond_work, hns_roce_do_bond_work); + init_completion(&bond_grp->bond_work_done); - return ret; -} + bond_grp->bond_ready = false; + bond_grp->bond_state = HNS_ROCE_BOND_NOT_ATTACHED; + bond_grp->bus_num = get_hr_bus_num(hr_dev); -static bool hns_roce_bond_lowerstate_event(struct hns_roce_dev *hr_dev, - struct hns_roce_bond_group *bond_grp, - struct netdev_notifier_changelowerstate_info *info) -{ - struct net_device *net_dev = - netdev_notifier_info_to_dev((struct netdev_notifier_info *)info); + ret = alloc_bond_id(bond_grp); + if (ret) { + ibdev_err(&hr_dev->ib_dev, + "failed to alloc bond ID, ret = %d.\n", ret); + goto alloc_id_err; + } - if (!netif_is_lag_port(net_dev) || - (!bond_grp || hr_dev != bond_grp->main_hr_dev)) - return false; + bond_grp->bond_nb.notifier_call = hns_roce_bond_event; + ret = register_netdevice_notifier(&bond_grp->bond_nb); + if (ret) { + ibdev_err(&hr_dev->ib_dev, + "failed to register bond nb, ret = %d.\n", ret); + goto register_nb_err; + } + bgrps[i] = bond_grp; + } - mutex_lock(&bond_grp->bond_mutex); + return 0; - if (bond_grp->bond_ready && - bond_grp->bond_state == HNS_ROCE_BOND_IS_BONDED) - bond_grp->bond_state = HNS_ROCE_BOND_SLAVE_CHANGESTATE; +register_nb_err: + remove_bond_id(bond_grp->bus_num, bond_grp->bond_id); +alloc_id_err: + mutex_destroy(&bond_grp->bond_mutex); + kvfree(bond_grp); +mem_err: + for (i--; i >= 0; i--) { + unregister_netdevice_notifier(&bgrps[i]->bond_nb); + cancel_delayed_work_sync(&bgrps[i]->bond_work); + complete(&bgrps[i]->bond_work_done); + remove_bond_id(bgrps[i]->bus_num, bgrps[i]->bond_id); + mutex_destroy(&bgrps[i]->bond_mutex); + kvfree(bgrps[i]); + } + return ret; +} - mutex_unlock(&bond_grp->bond_mutex); +void hns_roce_dealloc_bond_grp(void) +{ + struct hns_roce_bond_group *bond_grp; + struct hns_roce_die_info *die_info; + unsigned long id; + int i; - return true; + xa_for_each(&roce_bond_xa, id, die_info) { + for (i = 0; i < ROCE_BOND_NUM_MAX; i++) { + bond_grp = die_info->bgrps[i]; + if (!bond_grp) + continue; + unregister_netdevice_notifier(&bond_grp->bond_nb); + cancel_delayed_work_sync(&bond_grp->bond_work); + remove_bond_id(bond_grp->bus_num, bond_grp->bond_id); + mutex_destroy(&bond_grp->bond_mutex); + kvfree(bond_grp); + } + } } -static bool is_bond_setting_supported(struct netdev_lag_upper_info *bond_info) +int hns_roce_bond_init(struct hns_roce_dev *hr_dev) { - if (!bond_info) - return false; + struct net_device *net_dev = get_hr_netdev(hr_dev, 0); + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hns_roce_bond_group *bond_grp; + u8 bus_num = get_hr_bus_num(hr_dev); + int ret = 0; - if (bond_info->tx_type != NETDEV_LAG_TX_TYPE_ACTIVEBACKUP && - bond_info->tx_type != NETDEV_LAG_TX_TYPE_HASH) - return false; + if (priv->handle->rinfo.reset_state == HNS_ROCE_STATE_RST_INIT) { + bond_grp = hns_roce_get_bond_grp(net_dev, bus_num); + if (!bond_grp) + return 0; - if (bond_info->tx_type == NETDEV_LAG_TX_TYPE_HASH && - bond_info->hash_type > NETDEV_LAG_HASH_L23) - return false; + bond_grp->main_hr_dev = hr_dev; + ret = hns_roce_recover_bond(bond_grp); + if (ret) + ibdev_err(&hr_dev->ib_dev, + "failed to recover RoCE bond, ret = %d.\n", + ret); + return ret; + } - return true; + if (!xa_load(&roce_bond_xa, bus_num)) { + ret = hns_roce_alloc_bond_grp(hr_dev); + if (ret) + ibdev_err(&hr_dev->ib_dev, + "failed to alloc RoCE bond, ret = %d.\n", + ret); + } + + return ret; } static void hns_roce_bond_info_update(struct hns_roce_bond_group *bond_grp, @@ -716,6 +708,80 @@ static void hns_roce_bond_info_update(struct hns_roce_bond_group *bond_grp, rcu_read_unlock(); } +static void hns_roce_attach_bond_grp(struct hns_roce_bond_group *bond_grp, + struct hns_roce_dev *hr_dev, + struct net_device *upper_dev) +{ + bond_grp->upper_dev = upper_dev; + bond_grp->main_hr_dev = hr_dev; + bond_grp->bond_state = HNS_ROCE_BOND_NOT_BONDED; + bond_grp->bond_ready = false; + hns_roce_bond_info_update(bond_grp, upper_dev, true); +} + +static void hns_roce_detach_bond_grp(struct hns_roce_bond_group *bond_grp) +{ + cancel_delayed_work(&bond_grp->bond_work); + bond_grp->upper_dev = NULL; + bond_grp->main_hr_dev = NULL; + bond_grp->bond_ready = false; + bond_grp->bond_state = HNS_ROCE_BOND_NOT_ATTACHED; + bond_grp->slave_map = 0; + bond_grp->slave_map_diff = 0; + memset(bond_grp->bond_func_info, 0, sizeof(bond_grp->bond_func_info)); +} + +int hns_roce_cleanup_bond(struct hns_roce_bond_group *bond_grp) +{ + int ret; + + ret = bond_grp->main_hr_dev ? + hns_roce_cmd_bond(bond_grp, HNS_ROCE_CLEAR_BOND) : -EIO; + if (ret) + BOND_ERR_LOG("failed to clear RoCE bond, ret = %d.\n", ret); + + hns_roce_detach_bond_grp(bond_grp); + complete(&bond_grp->bond_work_done); + + return ret; +} + +static bool hns_roce_bond_lowerstate_event(struct hns_roce_bond_group *bond_grp, + struct netdev_notifier_changelowerstate_info *info) +{ + struct net_device *net_dev = + netdev_notifier_info_to_dev((struct netdev_notifier_info *)info); + + if (!netif_is_lag_port(net_dev)) + return false; + + mutex_lock(&bond_grp->bond_mutex); + + if (bond_grp->bond_ready && + bond_grp->bond_state == HNS_ROCE_BOND_IS_BONDED) + bond_grp->bond_state = HNS_ROCE_BOND_SLAVE_CHANGESTATE; + + mutex_unlock(&bond_grp->bond_mutex); + + return true; +} + +static bool is_bond_setting_supported(struct netdev_lag_upper_info *bond_info) +{ + if (!bond_info) + return false; + + if (bond_info->tx_type != NETDEV_LAG_TX_TYPE_ACTIVEBACKUP && + bond_info->tx_type != NETDEV_LAG_TX_TYPE_HASH) + return false; + + if (bond_info->tx_type == NETDEV_LAG_TX_TYPE_HASH && + bond_info->hash_type > NETDEV_LAG_HASH_L23) + return false; + + return true; +} + static bool hns_roce_bond_upper_event(struct hns_roce_bond_group *bond_grp, struct netdev_notifier_changeupper_info *info) { @@ -755,44 +821,8 @@ static bool hns_roce_bond_upper_event(struct hns_roce_bond_group *bond_grp, return changed; } -static struct hns_roce_bond_group *hns_roce_alloc_bond_grp(struct hns_roce_dev *main_hr_dev, - struct net_device *upper_dev) -{ - struct hns_roce_bond_group *bond_grp; - int ret; - - bond_grp = kzalloc(sizeof(*bond_grp), GFP_KERNEL); - if (!bond_grp) - return NULL; - - mutex_init(&bond_grp->bond_mutex); - - INIT_DELAYED_WORK(&bond_grp->bond_work, hns_roce_do_bond_work); - - init_completion(&bond_grp->bond_work_done); - - bond_grp->upper_dev = upper_dev; - bond_grp->main_hr_dev = main_hr_dev; - bond_grp->bond_ready = false; - bond_grp->bond_state = HNS_ROCE_BOND_NOT_BONDED; - bond_grp->bus_num = main_hr_dev->pci_dev->bus->number; - - ret = alloc_bond_id(bond_grp); - if (ret) { - ibdev_err(&main_hr_dev->ib_dev, - "failed to alloc bond ID, ret = %d.\n", ret); - mutex_destroy(&bond_grp->bond_mutex); - kfree(bond_grp); - return NULL; - } - - hns_roce_bond_info_update(bond_grp, upper_dev, true); - - return bond_grp; -} - static bool is_dev_bond_supported(struct hns_roce_bond_group *bond_grp, - struct net_device *net_dev, int bus_num) + struct net_device *net_dev) { struct hns_roce_dev *hr_dev = hns_roce_get_hrdev_by_netdev(net_dev); @@ -810,7 +840,7 @@ static bool is_dev_bond_supported(struct hns_roce_bond_group *bond_grp, if (hr_dev->is_vf || pci_num_vf(hr_dev->pci_dev) > 0) return false; - if (bus_num != get_hr_bus_num(hr_dev)) + if (bond_grp->bus_num != get_hr_bus_num(hr_dev)) return false; return true; @@ -833,8 +863,7 @@ static bool check_unlinking_bond_support(struct hns_roce_bond_group *bond_grp) static bool check_linking_bond_support(struct netdev_lag_upper_info *bond_info, struct hns_roce_bond_group *bond_grp, - struct net_device *upper_dev, - int bus_num) + struct net_device *upper_dev) { struct net_device *net_dev; u8 slave_num = 0; @@ -844,7 +873,7 @@ static bool check_linking_bond_support(struct netdev_lag_upper_info *bond_info, rcu_read_lock(); for_each_netdev_in_bond_rcu(upper_dev, net_dev) { - if (is_dev_bond_supported(bond_grp, net_dev, bus_num)) { + if (is_dev_bond_supported(bond_grp, net_dev)) { slave_num++; } else { rcu_read_unlock(); @@ -857,19 +886,14 @@ static bool check_linking_bond_support(struct netdev_lag_upper_info *bond_info, } static enum bond_support_type - check_bond_support(struct hns_roce_dev *hr_dev, - struct net_device **upper_dev, + check_bond_support(struct hns_roce_bond_group *bond_grp, + struct net_device *upper_dev, struct netdev_notifier_changeupper_info *info) { - struct net_device *net_dev = get_hr_netdev(hr_dev, 0); - struct hns_roce_bond_group *bond_grp; - int bus_num = get_hr_bus_num(hr_dev); bool bond_grp_exist = false; bool support; - *upper_dev = info->upper_dev; - bond_grp = hns_roce_get_bond_grp(net_dev, bus_num); - if (bond_grp && *upper_dev == bond_grp->upper_dev) + if (upper_dev == bond_grp->upper_dev) bond_grp_exist = true; if (!info->linking && !bond_grp_exist) @@ -877,7 +901,7 @@ static enum bond_support_type if (info->linking) support = check_linking_bond_support(info->upper_info, bond_grp, - *upper_dev, bus_num); + upper_dev); else support = check_unlinking_bond_support(bond_grp); @@ -887,16 +911,56 @@ static enum bond_support_type return bond_grp_exist ? BOND_EXISTING_NOT_SUPPORT : BOND_NOT_SUPPORT; } +static bool upper_event_filter(struct netdev_notifier_changeupper_info *info, + struct hns_roce_bond_group *bond_grp, + struct net_device *net_dev) +{ + struct net_device *upper_dev = info->upper_dev; + struct hns_roce_bond_group *bond_grp_tmp; + struct hns_roce_dev *hr_dev; + u8 bus_num; + + if (!info->linking) + return bond_grp->upper_dev == upper_dev; + + hr_dev = hns_roce_get_hrdev_by_netdev(net_dev); + if (!hr_dev) + return false; + + bus_num = get_hr_bus_num(hr_dev); + if (bond_grp->bus_num != bus_num) + return false; + + bond_grp_tmp = hns_roce_get_bond_grp(net_dev, bus_num); + if (bond_grp_tmp && bond_grp_tmp != bond_grp) + return false; + + if (bond_grp->bond_state != HNS_ROCE_BOND_NOT_ATTACHED && + bond_grp->upper_dev != upper_dev) + return false; + + return true; +} + +static bool lowerstate_event_filter(struct hns_roce_bond_group *bond_grp, + struct net_device *net_dev) +{ + struct hns_roce_bond_group *bond_grp_tmp; + + bond_grp_tmp = hns_roce_get_bond_grp(net_dev, bond_grp->bus_num); + return bond_grp_tmp == bond_grp; +} + int hns_roce_bond_event(struct notifier_block *self, unsigned long event, void *ptr) { + struct hns_roce_bond_group *bond_grp = + container_of(self, struct hns_roce_bond_group, bond_nb); struct net_device *net_dev = netdev_notifier_info_to_dev(ptr); - struct hns_roce_dev *hr_dev = - container_of(self, struct hns_roce_dev, bond_nb); + struct netdev_notifier_changeupper_info *info; enum bond_support_type support = BOND_SUPPORT; - struct hns_roce_bond_group *bond_grp; - u8 bus_num = get_hr_bus_num(hr_dev); struct net_device *upper_dev; + struct hns_roce_dev *hr_dev; bool changed; int slave_id; @@ -904,30 +968,27 @@ int hns_roce_bond_event(struct notifier_block *self, return NOTIFY_DONE; if (event == NETDEV_CHANGEUPPER) { - support = check_bond_support(hr_dev, &upper_dev, ptr); + if (!upper_event_filter(ptr, bond_grp, net_dev)) + return NOTIFY_DONE; + info = (struct netdev_notifier_changeupper_info *)ptr; + upper_dev = info->upper_dev; + support = check_bond_support(bond_grp, upper_dev, ptr); if (support == BOND_NOT_SUPPORT) return NOTIFY_DONE; } else { + if (!lowerstate_event_filter(bond_grp, net_dev)) + return NOTIFY_DONE; upper_dev = get_upper_dev_from_ndev(net_dev); } - if (upper_dev && !is_hrdev_bond_slave(hr_dev, upper_dev)) - return NOTIFY_DONE; - else if (!upper_dev && hr_dev != hns_roce_get_hrdev_by_netdev(net_dev)) - return NOTIFY_DONE; - - bond_grp = hns_roce_get_bond_grp(get_hr_netdev(hr_dev, 0), bus_num); if (event == NETDEV_CHANGEUPPER) { - if (!bond_grp) { - bond_grp = hns_roce_alloc_bond_grp(hr_dev, upper_dev); - if (!bond_grp) { - ibdev_err(&hr_dev->ib_dev, - "failed to alloc RoCE bond_grp!\n"); + if (bond_grp->bond_state == HNS_ROCE_BOND_NOT_ATTACHED) { + hr_dev = hns_roce_get_hrdev_by_netdev(net_dev); + if (!hr_dev) return NOTIFY_DONE; - } - } else if (hr_dev != bond_grp->main_hr_dev) { - return NOTIFY_DONE; + hns_roce_attach_bond_grp(bond_grp, hr_dev, upper_dev); } + /* In the case of netdev being unregistered, the roce * instance shouldn't be inited. */ @@ -944,7 +1005,7 @@ int hns_roce_bond_event(struct notifier_block *self, } changed = hns_roce_bond_upper_event(bond_grp, ptr); } else { - changed = hns_roce_bond_lowerstate_event(hr_dev, bond_grp, ptr); + changed = hns_roce_bond_lowerstate_event(bond_grp, ptr); } if (changed) hns_roce_queue_bond_work(bond_grp, HZ); diff --git a/drivers/infiniband/hw/hns/hns_roce_bond.h b/drivers/infiniband/hw/hns/hns_roce_bond.h index 75c9d670de7c..ba82ec12e4e5 100644 --- a/drivers/infiniband/hw/hns/hns_roce_bond.h +++ b/drivers/infiniband/hw/hns/hns_roce_bond.h @@ -33,6 +33,7 @@ enum bond_support_type { }; enum hns_roce_bond_state { + HNS_ROCE_BOND_NOT_ATTACHED, HNS_ROCE_BOND_NOT_BONDED, HNS_ROCE_BOND_IS_BONDED, HNS_ROCE_BOND_REGISTERING, @@ -72,6 +73,7 @@ struct hns_roce_bond_group { struct hns_roce_func_info bond_func_info[ROCE_BOND_FUNC_MAX]; struct delayed_work bond_work; struct completion bond_work_done; + struct notifier_block bond_nb; }; struct hns_roce_die_info { @@ -88,5 +90,6 @@ struct net_device *hns_roce_get_bond_netdev(struct hns_roce_dev *hr_dev); struct hns_roce_bond_group *hns_roce_get_bond_grp(struct net_device *net_dev, u8 bus_num); bool is_bond_slave_in_reset(struct hns_roce_bond_group *bond_grp); +void hns_roce_dealloc_bond_grp(void); #endif diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 0f1b87f8c75b..8add4742c094 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -1154,7 +1154,6 @@ struct hns_roce_dev { struct hns_roce_dev_debugfs dbgfs; atomic64_t *dfx_cnt; struct hns_roce_scc_param *scc_param; - struct notifier_block bond_nb; struct list_head mtr_unfree_list; /* list of unfree mtr on this dev */ struct mutex mtr_unfree_list_mutex; /* protect mtr_unfree_list */ diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 2568609edb60..54ea073db0d0 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -2388,6 +2388,9 @@ static int hns_roce_query_caps(struct hns_roce_dev *hr_dev) caps->flags |= le16_to_cpu(resp_d->cap_flags_ex) << HNS_ROCE_CAP_FLAGS_EX_SHIFT; + if (hr_dev->is_vf) + caps->flags &= ~HNS_ROCE_CAP_FLAG_BOND; + caps->num_cqs = 1 << hr_reg_read(resp_c, PF_CAPS_C_NUM_CQS); caps->gid_table_len[0] = hr_reg_read(resp_c, PF_CAPS_C_MAX_GID); caps->max_cqes = 1 << hr_reg_read(resp_c, PF_CAPS_C_CQ_DEPTH); @@ -7460,11 +7463,8 @@ static void hns_roce_hw_v2_uninit_instance(struct hnae3_handle *handle, if (handle->rinfo.instance_state == HNS_ROCE_STATE_BOND_UNINIT) { bond_grp = hns_roce_get_bond_grp(handle->rinfo.netdev, handle->pdev->bus->number); - if (bond_grp) { + if (bond_grp) wait_for_completion(&bond_grp->bond_work_done); - if (bond_grp->bond_state == HNS_ROCE_BOND_NOT_BONDED) - kfree(bond_grp); - } } if (handle->rinfo.instance_state != HNS_ROCE_STATE_INITED) @@ -7705,6 +7705,7 @@ static int __init hns_roce_hw_v2_init(void) static void __exit hns_roce_hw_v2_exit(void) { + hns_roce_dealloc_bond_grp(); hnae3_unregister_client(&hns_roce_hw_v2_client); hns_roce_cleanup_debugfs(); } diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 3628dbb250ab..725f2f08cb0b 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -856,7 +856,6 @@ static void hns_roce_unregister_device(struct hns_roce_dev *hr_dev, if (!(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_BOND)) goto normal_unregister; - unregister_netdevice_notifier(&hr_dev->bond_nb); bond_grp = hns_roce_get_bond_grp(net_dev, bus_num); if (!bond_grp) goto normal_unregister; @@ -866,6 +865,7 @@ static void hns_roce_unregister_device(struct hns_roce_dev *hr_dev, * is unregistered, re-initialized the remaining slaves before * the bond resources cleanup. */ + cancel_delayed_work_sync(&bond_grp->bond_work); bond_grp->bond_state = HNS_ROCE_BOND_NOT_BONDED; for (i = 0; i < ROCE_BOND_FUNC_MAX; i++) { net_dev = bond_grp->bond_func_info[i].net_dev; -- 2.33.0

1 3

[PATCH openEuler-22.03-LTS-SP1] netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
by Wang Hai 08 Aug '24

08 Aug '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.221 commit 5d43d789b57943720dca4181a05f6477362b94cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEO4 CVE: CVE-2024-42070 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7931d32955e09d0a11b1fe0b6aac1bfa061c005c ] register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This only requires a new helper function to infer the register type from the set datatype so this conditional check can be removed. Otherwise, pointer to chain object can be leaked through the registers. Fixes: 96518518cc41 ("netfilter: add nftables") Reported-by: Linus Torvalds <torvalds(a)linuxfoundation.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: include/net/netfilter/nf_tables.h [just context conflict] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- include/net/netfilter/nf_tables.h | 5 +++++ net/netfilter/nf_tables_api.c | 8 ++++---- net/netfilter/nft_lookup.c | 3 ++- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index 7550328080bf..6ab0312e3f28 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -475,6 +475,11 @@ static inline void *nft_set_priv(const struct nft_set *set) return (void *)set->data; } +static inline enum nft_data_types nft_set_datatype(const struct nft_set *set) +{ + return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; +} + static inline struct nft_set *nft_set_container_of(const void *priv) { return (void *)priv - offsetof(struct nft_set, data); diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 990fdecca0d2..f3492376bf74 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4896,8 +4896,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb, if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), - set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, - set->dlen) < 0) + nft_set_datatype(set), set->dlen) < 0) goto nla_put_failure; if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) && @@ -8841,6 +8840,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, return 0; default: + if (type != NFT_DATA_VALUE) + return -EINVAL; + if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) return -EINVAL; if (len == 0) @@ -8849,8 +8851,6 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, sizeof_field(struct nft_regs, data)) return -ERANGE; - if (data != NULL && type != NFT_DATA_VALUE) - return -EINVAL; return 0; } } diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c index 8bc008ff00cb..d2f8131edaf1 100644 --- a/net/netfilter/nft_lookup.c +++ b/net/netfilter/nft_lookup.c @@ -101,7 +101,8 @@ static int nft_lookup_init(const struct nft_ctx *ctx, return -EINVAL; err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG], - &priv->dreg, NULL, set->dtype, + &priv->dreg, NULL, + nft_set_datatype(set), set->dlen); if (err < 0) return err; -- 2.17.1

2 1

[PATCH OLK-5.10] netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
by Wang Hai 08 Aug '24

08 Aug '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.221 commit 5d43d789b57943720dca4181a05f6477362b94cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEO4 CVE: CVE-2024-42070 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7931d32955e09d0a11b1fe0b6aac1bfa061c005c ] register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This only requires a new helper function to infer the register type from the set datatype so this conditional check can be removed. Otherwise, pointer to chain object can be leaked through the registers. Fixes: 96518518cc41 ("netfilter: add nftables") Reported-by: Linus Torvalds <torvalds(a)linuxfoundation.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- include/net/netfilter/nf_tables.h | 5 +++++ net/netfilter/nf_tables_api.c | 8 ++++---- net/netfilter/nft_lookup.c | 3 ++- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index 5e3529c73e61..17659138e15a 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -504,6 +504,11 @@ static inline void *nft_set_priv(const struct nft_set *set) return (void *)set->data; } +static inline enum nft_data_types nft_set_datatype(const struct nft_set *set) +{ + return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; +} + static inline bool nft_set_gc_is_pending(const struct nft_set *s) { return refcount_read(&s->refs) != 1; diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 79fe3743502b..f990851709a3 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -5019,8 +5019,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb, if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), - set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, - set->dlen) < 0) + nft_set_datatype(set), set->dlen) < 0) goto nla_put_failure; if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) && @@ -9277,6 +9276,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, return 0; default: + if (type != NFT_DATA_VALUE) + return -EINVAL; + if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) return -EINVAL; if (len == 0) @@ -9285,8 +9287,6 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, sizeof_field(struct nft_regs, data)) return -ERANGE; - if (data != NULL && type != NFT_DATA_VALUE) - return -EINVAL; return 0; } } diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c index c2dd1d3ac328..f6ea1b32dae1 100644 --- a/net/netfilter/nft_lookup.c +++ b/net/netfilter/nft_lookup.c @@ -101,7 +101,8 @@ static int nft_lookup_init(const struct nft_ctx *ctx, return -EINVAL; err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG], - &priv->dreg, NULL, set->dtype, + &priv->dreg, NULL, + nft_set_datatype(set), set->dlen); if (err < 0) return err; -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
by Wang Hai 08 Aug '24

08 Aug '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v4.19.317 commit 40188a25a9847dbeb7ec67517174a835a677752f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ CVE: CVE-2024-42070 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7931d32955e09d0a11b1fe0b6aac1bfa061c005c ] register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This only requires a new helper function to infer the register type from the set datatype so this conditional check can be removed. Otherwise, pointer to chain object can be leaked through the registers. Fixes: 96518518cc41 ("netfilter: add nftables") Reported-by: Linus Torvalds <torvalds(a)linuxfoundation.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: include/net/netfilter/nf_tables.h net/netfilter/nft_lookup.c [nf_tables.h conflicts due to context, nft_lookup.c conflicts because e1c59f90e1a6 ("netfilter: nftables: add nft_parse_register_store() and use it") is not merged.] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- include/net/netfilter/nf_tables.h | 5 +++++ net/netfilter/nf_tables_api.c | 8 ++++---- net/netfilter/nft_lookup.c | 2 +- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index ecc301ee1556..247e4637b458 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -438,6 +438,11 @@ static inline void *nft_set_priv(const struct nft_set *set) return (void *)set->data; } +static inline enum nft_data_types nft_set_datatype(const struct nft_set *set) +{ + return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; +} + static inline struct nft_set *nft_set_container_of(const void *priv) { return (void *)priv - offsetof(struct nft_set, data); diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 97e56cadb4bf..133cff3a3f77 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3961,8 +3961,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb, if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), - set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE, - set->dlen) < 0) + nft_set_datatype(set), set->dlen) < 0) goto nla_put_failure; if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) && @@ -7174,6 +7173,9 @@ int nft_validate_register_store(const struct nft_ctx *ctx, return 0; default: + if (type != NFT_DATA_VALUE) + return -EINVAL; + if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) return -EINVAL; if (len == 0) @@ -7182,8 +7184,6 @@ int nft_validate_register_store(const struct nft_ctx *ctx, FIELD_SIZEOF(struct nft_regs, data)) return -ERANGE; - if (data != NULL && type != NFT_DATA_VALUE) - return -EINVAL; return 0; } } diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c index cb9e937a5ce0..0d7a21ec9b11 100644 --- a/net/netfilter/nft_lookup.c +++ b/net/netfilter/nft_lookup.c @@ -102,7 +102,7 @@ static int nft_lookup_init(const struct nft_ctx *ctx, priv->dreg = nft_parse_register(tb[NFTA_LOOKUP_DREG]); err = nft_validate_register_store(ctx, priv->dreg, NULL, - set->dtype, set->dlen); + nft_set_datatype(set), set->dlen); if (err < 0) return err; } else if (set->flags & NFT_SET_MAP) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: nf_tables: prefer nft_chain_validate
by Wang Hai 08 Aug '24

08 Aug '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.10 commit cff3bd012a9512ac5ed858d38e6ed65f6391008c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEMR CVE: CVE-2024-41042 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It also follows maps via ->validate callback in nft_lookup, so there appears no reason to iterate the maps again. nf_tables_check_loops() and all its helper functions can be removed. This improves ruleset load time significantly, from 23s down to 12s. This also fixes a crash bug. Old loop detection code can result in unbounded recursion: BUG: TASK stack guard page was hit at .... Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1 [..] with a suitable ruleset during validation of register stores. I can't see any actual reason to attempt to check for this from nft_validate_register_store(), at this point the transaction is still in progress, so we don't have a full picture of the rule graph. For nf-next it might make sense to either remove it or make this depend on table->validate_state in case we could catch an error earlier (for improved error reporting to userspace). Fixes: 20a69341f2d0 ("netfilter: nf_tables: add netlink set API") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [Because the deleted function had some patches that were not merged in, resulting in conflicts] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/netfilter/nf_tables_api.c | 115 ++++------------------------------ 1 file changed, 13 insertions(+), 102 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 6105149b9e1a..990fdecca0d2 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3288,6 +3288,15 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *r nf_tables_rule_destroy(ctx, rule); } +/** nft_chain_validate - loop detection and hook validation + * + * @ctx: context containing call depth and base chain + * @chain: chain to validate + * + * Walk through the rules of the given chain and chase all jumps/gotos + * and set lookups until either the jump limit is hit or all reachable + * chains have been validated. + */ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) { struct nft_expr *expr, *last; @@ -3306,6 +3315,9 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) if (!expr->ops->validate) continue; + /* This may call nft_chain_validate() recursively, + * callers that do so must increment ctx->level. + */ err = expr->ops->validate(ctx, expr, &data); if (err < 0) return err; @@ -8677,107 +8689,6 @@ int nft_chain_validate_hooks(const struct nft_chain *chain, } EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); -/* - * Loop detection - walk through the ruleset beginning at the destination chain - * of a new jump until either the source chain is reached (loop) or all - * reachable chains have been traversed. - * - * The loop check is performed whenever a new jump verdict is added to an - * expression or verdict map or a verdict map is bound to a new chain. - */ - -static int nf_tables_check_loops(const struct nft_ctx *ctx, - const struct nft_chain *chain); - -static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, - struct nft_set *set, - const struct nft_set_iter *iter, - struct nft_set_elem *elem) -{ - const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); - const struct nft_data *data; - - if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && - *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) - return 0; - - data = nft_set_ext_data(ext); - switch (data->verdict.code) { - case NFT_JUMP: - case NFT_GOTO: - return nf_tables_check_loops(ctx, data->verdict.chain); - default: - return 0; - } -} - -static int nf_tables_check_loops(const struct nft_ctx *ctx, - const struct nft_chain *chain) -{ - const struct nft_rule *rule; - const struct nft_expr *expr, *last; - struct nft_set *set; - struct nft_set_binding *binding; - struct nft_set_iter iter; - - if (ctx->chain == chain) - return -ELOOP; - - list_for_each_entry(rule, &chain->rules, list) { - nft_rule_for_each_expr(expr, last, rule) { - struct nft_immediate_expr *priv; - const struct nft_data *data; - int err; - - if (strcmp(expr->ops->type->name, "immediate")) - continue; - - priv = nft_expr_priv(expr); - if (priv->dreg != NFT_REG_VERDICT) - continue; - - data = &priv->data; - switch (data->verdict.code) { - case NFT_JUMP: - case NFT_GOTO: - err = nf_tables_check_loops(ctx, - data->verdict.chain); - if (err < 0) - return err; - break; - default: - break; - } - } - } - - list_for_each_entry(set, &ctx->table->sets, list) { - if (!nft_is_active_next(ctx->net, set)) - continue; - if (!(set->flags & NFT_SET_MAP) || - set->dtype != NFT_DATA_VERDICT) - continue; - - list_for_each_entry(binding, &set->bindings, list) { - if (!(binding->flags & NFT_SET_MAP) || - binding->chain != chain) - continue; - - iter.genmask = nft_genmask_next(ctx->net); - iter.skip = 0; - iter.count = 0; - iter.err = 0; - iter.fn = nf_tables_loop_check_setelem; - - set->ops->walk(ctx, set, &iter); - if (iter.err < 0) - return iter.err; - } - } - - return 0; -} - /** * nft_parse_u32_check - fetch u32 attribute and check for maximum value * @@ -8923,7 +8834,7 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, if (data != NULL && (data->verdict.code == NFT_GOTO || data->verdict.code == NFT_JUMP)) { - err = nf_tables_check_loops(ctx, data->verdict.chain); + err = nft_chain_validate(ctx, data->verdict.chain); if (err < 0) return err; } -- 2.17.1

2 1

[PATCH OLK-6.6] netfilter: nf_tables: prefer nft_chain_validate
by Wang Hai 08 Aug '24

08 Aug '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.10 commit cff3bd012a9512ac5ed858d38e6ed65f6391008c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEMR CVE: CVE-2024-41042 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It also follows maps via ->validate callback in nft_lookup, so there appears no reason to iterate the maps again. nf_tables_check_loops() and all its helper functions can be removed. This improves ruleset load time significantly, from 23s down to 12s. This also fixes a crash bug. Old loop detection code can result in unbounded recursion: BUG: TASK stack guard page was hit at .... Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1 [..] with a suitable ruleset during validation of register stores. I can't see any actual reason to attempt to check for this from nft_validate_register_store(), at this point the transaction is still in progress, so we don't have a full picture of the rule graph. For nf-next it might make sense to either remove it or make this depend on table->validate_state in case we could catch an error earlier (for improved error reporting to userspace). Fixes: 20a69341f2d0 ("netfilter: nf_tables: add netlink set API") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [Because the deleted function had some patches that were not merged in, resulting in conflicts] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/netfilter/nf_tables_api.c | 154 +++------------------------------- 1 file changed, 13 insertions(+), 141 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index dd044a47c872..ea139fca74cb 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3743,6 +3743,15 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *r nf_tables_rule_destroy(ctx, rule); } +/** nft_chain_validate - loop detection and hook validation + * + * @ctx: context containing call depth and base chain + * @chain: chain to validate + * + * Walk through the rules of the given chain and chase all jumps/gotos + * and set lookups until either the jump limit is hit or all reachable + * chains have been validated. + */ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) { struct nft_expr *expr, *last; @@ -3764,6 +3773,9 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) if (!expr->ops->validate) continue; + /* This may call nft_chain_validate() recursively, + * callers that do so must increment ctx->level. + */ err = expr->ops->validate(ctx, expr, &data); if (err < 0) return err; @@ -10621,146 +10633,6 @@ int nft_chain_validate_hooks(const struct nft_chain *chain, } EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); -/* - * Loop detection - walk through the ruleset beginning at the destination chain - * of a new jump until either the source chain is reached (loop) or all - * reachable chains have been traversed. - * - * The loop check is performed whenever a new jump verdict is added to an - * expression or verdict map or a verdict map is bound to a new chain. - */ - -static int nf_tables_check_loops(const struct nft_ctx *ctx, - const struct nft_chain *chain); - -static int nft_check_loops(const struct nft_ctx *ctx, - const struct nft_set_ext *ext) -{ - const struct nft_data *data; - int ret; - - data = nft_set_ext_data(ext); - switch (data->verdict.code) { - case NFT_JUMP: - case NFT_GOTO: - ret = nf_tables_check_loops(ctx, data->verdict.chain); - break; - default: - ret = 0; - break; - } - - return ret; -} - -static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, - struct nft_set *set, - const struct nft_set_iter *iter, - struct nft_set_elem *elem) -{ - const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); - - if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && - *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) - return 0; - - return nft_check_loops(ctx, ext); -} - -static int nft_set_catchall_loops(const struct nft_ctx *ctx, - struct nft_set *set) -{ - u8 genmask = nft_genmask_next(ctx->net); - struct nft_set_elem_catchall *catchall; - struct nft_set_ext *ext; - int ret = 0; - - list_for_each_entry_rcu(catchall, &set->catchall_list, list) { - ext = nft_set_elem_ext(set, catchall->elem); - if (!nft_set_elem_active(ext, genmask)) - continue; - - ret = nft_check_loops(ctx, ext); - if (ret < 0) - return ret; - } - - return ret; -} - -static int nf_tables_check_loops(const struct nft_ctx *ctx, - const struct nft_chain *chain) -{ - const struct nft_rule *rule; - const struct nft_expr *expr, *last; - struct nft_set *set; - struct nft_set_binding *binding; - struct nft_set_iter iter; - - if (ctx->chain == chain) - return -ELOOP; - - if (fatal_signal_pending(current)) - return -EINTR; - - list_for_each_entry(rule, &chain->rules, list) { - nft_rule_for_each_expr(expr, last, rule) { - struct nft_immediate_expr *priv; - const struct nft_data *data; - int err; - - if (strcmp(expr->ops->type->name, "immediate")) - continue; - - priv = nft_expr_priv(expr); - if (priv->dreg != NFT_REG_VERDICT) - continue; - - data = &priv->data; - switch (data->verdict.code) { - case NFT_JUMP: - case NFT_GOTO: - err = nf_tables_check_loops(ctx, - data->verdict.chain); - if (err < 0) - return err; - break; - default: - break; - } - } - } - - list_for_each_entry(set, &ctx->table->sets, list) { - if (!nft_is_active_next(ctx->net, set)) - continue; - if (!(set->flags & NFT_SET_MAP) || - set->dtype != NFT_DATA_VERDICT) - continue; - - list_for_each_entry(binding, &set->bindings, list) { - if (!(binding->flags & NFT_SET_MAP) || - binding->chain != chain) - continue; - - iter.genmask = nft_genmask_next(ctx->net); - iter.skip = 0; - iter.count = 0; - iter.err = 0; - iter.fn = nf_tables_loop_check_setelem; - - set->ops->walk(ctx, set, &iter); - if (!iter.err) - iter.err = nft_set_catchall_loops(ctx, set); - - if (iter.err < 0) - return iter.err; - } - } - - return 0; -} - /** * nft_parse_u32_check - fetch u32 attribute and check for maximum value * @@ -10873,7 +10745,7 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, if (data != NULL && (data->verdict.code == NFT_GOTO || data->verdict.code == NFT_JUMP)) { - err = nf_tables_check_loops(ctx, data->verdict.chain); + err = nft_chain_validate(ctx, data->verdict.chain); if (err < 0) return err; } -- 2.17.1

2 1

[PATCH OLK-5.10] netfilter: nf_tables: prefer nft_chain_validate
by Wang Hai 08 Aug '24

08 Aug '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.10 commit cff3bd012a9512ac5ed858d38e6ed65f6391008c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEMR CVE: CVE-2024-41042 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It also follows maps via ->validate callback in nft_lookup, so there appears no reason to iterate the maps again. nf_tables_check_loops() and all its helper functions can be removed. This improves ruleset load time significantly, from 23s down to 12s. This also fixes a crash bug. Old loop detection code can result in unbounded recursion: BUG: TASK stack guard page was hit at .... Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1 [..] with a suitable ruleset during validation of register stores. I can't see any actual reason to attempt to check for this from nft_validate_register_store(), at this point the transaction is still in progress, so we don't have a full picture of the rule graph. For nf-next it might make sense to either remove it or make this depend on table->validate_state in case we could catch an error earlier (for improved error reporting to userspace). Fixes: 20a69341f2d0 ("netfilter: nf_tables: add netlink set API") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [Because the deleted function had some patches that were not merged in, resulting in conflicts] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/netfilter/nf_tables_api.c | 131 ++++------------------------------ 1 file changed, 13 insertions(+), 118 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 09e7a123c16c..79fe3743502b 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3355,6 +3355,15 @@ static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *r nf_tables_rule_destroy(ctx, rule); } +/** nft_chain_validate - loop detection and hook validation + * + * @ctx: context containing call depth and base chain + * @chain: chain to validate + * + * Walk through the rules of the given chain and chase all jumps/gotos + * and set lookups until either the jump limit is hit or all reachable + * chains have been validated. + */ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) { struct nft_expr *expr, *last; @@ -3373,6 +3382,9 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) if (!expr->ops->validate) continue; + /* This may call nft_chain_validate() recursively, + * callers that do so must increment ctx->level. + */ err = expr->ops->validate(ctx, expr, &data); if (err < 0) return err; @@ -9113,123 +9125,6 @@ int nft_chain_validate_hooks(const struct nft_chain *chain, } EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); -/* - * Loop detection - walk through the ruleset beginning at the destination chain - * of a new jump until either the source chain is reached (loop) or all - * reachable chains have been traversed. - * - * The loop check is performed whenever a new jump verdict is added to an - * expression or verdict map or a verdict map is bound to a new chain. - */ - -static int nf_tables_check_loops(const struct nft_ctx *ctx, - const struct nft_chain *chain); - -static int nft_check_loops(const struct nft_ctx *ctx, - const struct nft_set_ext *ext) -{ - const struct nft_data *data; - int ret; - - data = nft_set_ext_data(ext); - switch (data->verdict.code) { - case NFT_JUMP: - case NFT_GOTO: - ret = nf_tables_check_loops(ctx, data->verdict.chain); - break; - default: - ret = 0; - break; - } - - return ret; -} - -static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, - struct nft_set *set, - const struct nft_set_iter *iter, - struct nft_set_elem *elem) -{ - const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); - - if (!nft_set_elem_active(ext, iter->genmask)) - return 0; - - if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && - *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) - return 0; - - return nft_check_loops(ctx, ext); -} - -static int nf_tables_check_loops(const struct nft_ctx *ctx, - const struct nft_chain *chain) -{ - const struct nft_rule *rule; - const struct nft_expr *expr, *last; - struct nft_set *set; - struct nft_set_binding *binding; - struct nft_set_iter iter; - - if (ctx->chain == chain) - return -ELOOP; - - list_for_each_entry(rule, &chain->rules, list) { - nft_rule_for_each_expr(expr, last, rule) { - struct nft_immediate_expr *priv; - const struct nft_data *data; - int err; - - if (strcmp(expr->ops->type->name, "immediate")) - continue; - - priv = nft_expr_priv(expr); - if (priv->dreg != NFT_REG_VERDICT) - continue; - - data = &priv->data; - switch (data->verdict.code) { - case NFT_JUMP: - case NFT_GOTO: - err = nf_tables_check_loops(ctx, - data->verdict.chain); - if (err < 0) - return err; - break; - default: - break; - } - } - } - - list_for_each_entry(set, &ctx->table->sets, list) { - if (!nft_is_active_next(ctx->net, set)) - continue; - if (!(set->flags & NFT_SET_MAP) || - set->dtype != NFT_DATA_VERDICT) - continue; - - list_for_each_entry(binding, &set->bindings, list) { - if (!(binding->flags & NFT_SET_MAP) || - binding->chain != chain) - continue; - - iter.genmask = nft_genmask_next(ctx->net); - iter.type = NFT_ITER_UPDATE; - iter.skip = 0; - iter.count = 0; - iter.err = 0; - iter.fn = nf_tables_loop_check_setelem; - - set->ops->walk(ctx, set, &iter); - if (iter.err < 0) - return iter.err; - } - } - - return 0; -} - /** * nft_parse_u32_check - fetch u32 attribute and check for maximum value * @@ -9375,7 +9270,7 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, if (data != NULL && (data->verdict.code == NFT_GOTO || data->verdict.code == NFT_JUMP)) { - err = nf_tables_check_loops(ctx, data->verdict.chain); + err = nft_chain_validate(ctx, data->verdict.chain); if (err < 0) return err; } -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: gus: fix null pointer dereference on pointer block
by Kaixiong Yu 08 Aug '24

08 Aug '24

From: Chengfeng Ye <cyeaa(a)connect.ust.hk> stable inclusion from stable-v4.19.218 commit ab4c1ebc40f699f48346f634d7b72b9c5193f315 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFE CVE: CVE-2021-47207 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0d21bb3279476c777434c40d969ea88ca64f9aa ] The pointer block return from snd_gf1_dma_next_block could be null, so there is a potential null pointer dereference issue. Fix this by adding a null check before dereference. Signed-off-by: Chengfeng Ye <cyeaa(a)connect.ust.hk> Link: https://lore.kernel.org/r/20211024104611.9919-1-cyeaa@connect.ust.hk Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- sound/isa/gus/gus_dma.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c index 7f95f452f106..48e76b8fede4 100644 --- a/sound/isa/gus/gus_dma.c +++ b/sound/isa/gus/gus_dma.c @@ -141,6 +141,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus) } block = snd_gf1_dma_next_block(gus); spin_unlock(&gus->dma_lock); + if (!block) + return; snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd); kfree(block); #if 0 -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bnx2x: Fix multiple UBSAN array-index-out-of-bounds
by Wang Hai 08 Aug '24

08 Aug '24

From: Ghadi Elie Rahme <ghadi.rahme(a)canonical.com> stable inclusion from stable-v5.10.222 commit 8b17cec33892a66bbd71f8d9a70a45e2072ae84f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPSP CVE: CVE-2024-42148 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 134061163ee5ca4759de5c24ca3bd71608891ba7 upstream. Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FP_SB_MAX_E1x using the num_queues module parameter. Currently there is a read/write out of bounds that occurs on the array "struct stats_query_entry query" present inside the "bnx2x_fw_stats_req" struct in "drivers/net/ethernet/broadcom/bnx2x/bnx2x.h". Looking at the definition of the "struct stats_query_entry query" array: struct stats_query_entry query[FP_SB_MAX_E1x+ BNX2X_FIRST_QUEUE_QUERY_IDX]; FP_SB_MAX_E1x is defined as the maximum number of fast path interrupts and has a value of 16, while BNX2X_FIRST_QUEUE_QUERY_IDX has a value of 3 meaning the array has a total size of 19. Since accesses to "struct stats_query_entry query" are offset-ted by BNX2X_FIRST_QUEUE_QUERY_IDX, that means that the total number of Ethernet queues should not exceed FP_SB_MAX_E1x (16). However one of these queues is reserved for FCOE and thus the number of Ethernet queues should be set to [FP_SB_MAX_E1x -1] (15) if FCOE is enabled or [FP_SB_MAX_E1x] (16) if it is not. This is also described in a comment in the source code in drivers/net/ethernet/broadcom/bnx2x/bnx2x.h just above the Macro definition of FP_SB_MAX_E1x. Below is the part of this explanation that it important for this patch /* * The total number of L2 queues, MSIX vectors and HW contexts (CIDs) is * control by the number of fast-path status blocks supported by the * device (HW/FW). Each fast-path status block (FP-SB) aka non-default * status block represents an independent interrupts context that can * serve a regular L2 networking queue. However special L2 queues such * as the FCoE queue do not require a FP-SB and other components like * the CNIC may consume FP-SB reducing the number of possible L2 queues * * If the maximum number of FP-SB available is X then: * a. If CNIC is supported it consumes 1 FP-SB thus the max number of * regular L2 queues is Y=X-1 * b. In MF mode the actual number of L2 queues is Y= (X-1/MF_factor) * c. If the FCoE L2 queue is supported the actual number of L2 queues * is Y+1 * d. The number of irqs (MSIX vectors) is either Y+1 (one extra for * slow-path interrupts) or Y+2 if CNIC is supported (one additional * FP interrupt context for the CNIC). * e. The number of HW context (CID count) is always X or X+1 if FCoE * L2 queue is supported. The cid for the FCoE L2 queue is always X. */ However this driver also supports NICs that use the E2 controller which can handle more queues due to having more FP-SB represented by FP_SB_MAX_E2. Looking at the commits when the E2 support was added, it was originally using the E1x parameters: commit f2e0899f0f27 ("bnx2x: Add 57712 support"). Back then FP_SB_MAX_E2 was set to 16 the same as E1x. However the driver was later updated to take full advantage of the E2 instead of having it be limited to the capabilities of the E1x. But as far as we can tell, the array "stats_query_entry query" was still limited to using the FP-SB available to the E1x cards as part of an oversignt when the driver was updated to take full advantage of the E2, and now with the driver being aware of the greater queue size supported by E2 NICs, it causes the UBSAN warnings seen in the stack traces below. This patch increases the size of the "stats_query_entry query" array by replacing FP_SB_MAX_E1x with FP_SB_MAX_E2 to be large enough to handle both types of NICs. Stack traces: UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11 index 20 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_prep_fw_stats_req+0x2e1/0x310 [bnx2x] bnx2x_stats_init+0x156/0x320 [bnx2x] bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x] bnx2x_nic_load+0x8e8/0x19e0 [bnx2x] bnx2x_open+0x16b/0x290 [bnx2x] __dev_open+0x10e/0x1d0 RIP: 0033:0x736223927a0a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003 RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0 R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00 </TASK> ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1546:11 index 28 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_prep_fw_stats_req+0x2fd/0x310 [bnx2x] bnx2x_stats_init+0x156/0x320 [bnx2x] bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x] bnx2x_nic_load+0x8e8/0x19e0 [bnx2x] bnx2x_open+0x16b/0x290 [bnx2x] __dev_open+0x10e/0x1d0 RIP: 0033:0x736223927a0a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003 RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0 R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00 </TASK> ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1895:8 index 29 is out of range for type 'stats_query_entry [19]' CPU: 13 PID: 163 Comm: kworker/u96:1 Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Workqueue: bnx2x bnx2x_sp_task [bnx2x] Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_iov_adjust_stats_req+0x3c4/0x3d0 [bnx2x] bnx2x_storm_stats_post.part.0+0x4a/0x330 [bnx2x] ? bnx2x_hw_stats_post+0x231/0x250 [bnx2x] bnx2x_stats_start+0x44/0x70 [bnx2x] bnx2x_stats_handle+0x149/0x350 [bnx2x] bnx2x_attn_int_asserted+0x998/0x9b0 [bnx2x] bnx2x_sp_task+0x491/0x5c0 [bnx2x] process_one_work+0x18d/0x3f0 </TASK> ---[ end trace ]--- Fixes: 50f0a562f8cc ("bnx2x: add fcoe statistics") Signed-off-by: Ghadi Elie Rahme <ghadi.rahme(a)canonical.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20240627111405.1037812-1-ghadi.rahme@canonical.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h index 2a61229d3f97..c1fe9bcbb955 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h @@ -1262,7 +1262,7 @@ enum { struct bnx2x_fw_stats_req { struct stats_query_header hdr; - struct stats_query_entry query[FP_SB_MAX_E1x+ + struct stats_query_entry query[FP_SB_MAX_E2 + BNX2X_FIRST_QUEUE_QUERY_IDX]; }; -- 2.17.1

2 1

[PATCH OLK-5.10] bnx2x: Fix multiple UBSAN array-index-out-of-bounds
by Wang Hai 08 Aug '24

08 Aug '24

From: Ghadi Elie Rahme <ghadi.rahme(a)canonical.com> stable inclusion from stable-v5.10.222 commit 8b17cec33892a66bbd71f8d9a70a45e2072ae84f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPSP CVE: CVE-2024-42148 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 134061163ee5ca4759de5c24ca3bd71608891ba7 upstream. Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FP_SB_MAX_E1x using the num_queues module parameter. Currently there is a read/write out of bounds that occurs on the array "struct stats_query_entry query" present inside the "bnx2x_fw_stats_req" struct in "drivers/net/ethernet/broadcom/bnx2x/bnx2x.h". Looking at the definition of the "struct stats_query_entry query" array: struct stats_query_entry query[FP_SB_MAX_E1x+ BNX2X_FIRST_QUEUE_QUERY_IDX]; FP_SB_MAX_E1x is defined as the maximum number of fast path interrupts and has a value of 16, while BNX2X_FIRST_QUEUE_QUERY_IDX has a value of 3 meaning the array has a total size of 19. Since accesses to "struct stats_query_entry query" are offset-ted by BNX2X_FIRST_QUEUE_QUERY_IDX, that means that the total number of Ethernet queues should not exceed FP_SB_MAX_E1x (16). However one of these queues is reserved for FCOE and thus the number of Ethernet queues should be set to [FP_SB_MAX_E1x -1] (15) if FCOE is enabled or [FP_SB_MAX_E1x] (16) if it is not. This is also described in a comment in the source code in drivers/net/ethernet/broadcom/bnx2x/bnx2x.h just above the Macro definition of FP_SB_MAX_E1x. Below is the part of this explanation that it important for this patch /* * The total number of L2 queues, MSIX vectors and HW contexts (CIDs) is * control by the number of fast-path status blocks supported by the * device (HW/FW). Each fast-path status block (FP-SB) aka non-default * status block represents an independent interrupts context that can * serve a regular L2 networking queue. However special L2 queues such * as the FCoE queue do not require a FP-SB and other components like * the CNIC may consume FP-SB reducing the number of possible L2 queues * * If the maximum number of FP-SB available is X then: * a. If CNIC is supported it consumes 1 FP-SB thus the max number of * regular L2 queues is Y=X-1 * b. In MF mode the actual number of L2 queues is Y= (X-1/MF_factor) * c. If the FCoE L2 queue is supported the actual number of L2 queues * is Y+1 * d. The number of irqs (MSIX vectors) is either Y+1 (one extra for * slow-path interrupts) or Y+2 if CNIC is supported (one additional * FP interrupt context for the CNIC). * e. The number of HW context (CID count) is always X or X+1 if FCoE * L2 queue is supported. The cid for the FCoE L2 queue is always X. */ However this driver also supports NICs that use the E2 controller which can handle more queues due to having more FP-SB represented by FP_SB_MAX_E2. Looking at the commits when the E2 support was added, it was originally using the E1x parameters: commit f2e0899f0f27 ("bnx2x: Add 57712 support"). Back then FP_SB_MAX_E2 was set to 16 the same as E1x. However the driver was later updated to take full advantage of the E2 instead of having it be limited to the capabilities of the E1x. But as far as we can tell, the array "stats_query_entry query" was still limited to using the FP-SB available to the E1x cards as part of an oversignt when the driver was updated to take full advantage of the E2, and now with the driver being aware of the greater queue size supported by E2 NICs, it causes the UBSAN warnings seen in the stack traces below. This patch increases the size of the "stats_query_entry query" array by replacing FP_SB_MAX_E1x with FP_SB_MAX_E2 to be large enough to handle both types of NICs. Stack traces: UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11 index 20 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_prep_fw_stats_req+0x2e1/0x310 [bnx2x] bnx2x_stats_init+0x156/0x320 [bnx2x] bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x] bnx2x_nic_load+0x8e8/0x19e0 [bnx2x] bnx2x_open+0x16b/0x290 [bnx2x] __dev_open+0x10e/0x1d0 RIP: 0033:0x736223927a0a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003 RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0 R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00 </TASK> ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1546:11 index 28 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_prep_fw_stats_req+0x2fd/0x310 [bnx2x] bnx2x_stats_init+0x156/0x320 [bnx2x] bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x] bnx2x_nic_load+0x8e8/0x19e0 [bnx2x] bnx2x_open+0x16b/0x290 [bnx2x] __dev_open+0x10e/0x1d0 RIP: 0033:0x736223927a0a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003 RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0 R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00 </TASK> ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1895:8 index 29 is out of range for type 'stats_query_entry [19]' CPU: 13 PID: 163 Comm: kworker/u96:1 Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Workqueue: bnx2x bnx2x_sp_task [bnx2x] Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_iov_adjust_stats_req+0x3c4/0x3d0 [bnx2x] bnx2x_storm_stats_post.part.0+0x4a/0x330 [bnx2x] ? bnx2x_hw_stats_post+0x231/0x250 [bnx2x] bnx2x_stats_start+0x44/0x70 [bnx2x] bnx2x_stats_handle+0x149/0x350 [bnx2x] bnx2x_attn_int_asserted+0x998/0x9b0 [bnx2x] bnx2x_sp_task+0x491/0x5c0 [bnx2x] process_one_work+0x18d/0x3f0 </TASK> ---[ end trace ]--- Fixes: 50f0a562f8cc ("bnx2x: add fcoe statistics") Signed-off-by: Ghadi Elie Rahme <ghadi.rahme(a)canonical.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20240627111405.1037812-1-ghadi.rahme@canonical.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h index 2a61229d3f97..c1fe9bcbb955 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h @@ -1262,7 +1262,7 @@ enum { struct bnx2x_fw_stats_req { struct stats_query_header hdr; - struct stats_query_entry query[FP_SB_MAX_E1x+ + struct stats_query_entry query[FP_SB_MAX_E2 + BNX2X_FIRST_QUEUE_QUERY_IDX]; }; -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] bnx2x: Fix multiple UBSAN array-index-out-of-bounds
by Wang Hai 08 Aug '24

08 Aug '24

From: Ghadi Elie Rahme <ghadi.rahme(a)canonical.com> stable inclusion from stable-v4.19.318 commit cfb04472ce33bee2579caf4dc9f4242522f6e26e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPSP CVE: CVE-2024-42148 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 134061163ee5ca4759de5c24ca3bd71608891ba7 upstream. Fix UBSAN warnings that occur when using a system with 32 physical cpu cores or more, or when the user defines a number of Ethernet queues greater than or equal to FP_SB_MAX_E1x using the num_queues module parameter. Currently there is a read/write out of bounds that occurs on the array "struct stats_query_entry query" present inside the "bnx2x_fw_stats_req" struct in "drivers/net/ethernet/broadcom/bnx2x/bnx2x.h". Looking at the definition of the "struct stats_query_entry query" array: struct stats_query_entry query[FP_SB_MAX_E1x+ BNX2X_FIRST_QUEUE_QUERY_IDX]; FP_SB_MAX_E1x is defined as the maximum number of fast path interrupts and has a value of 16, while BNX2X_FIRST_QUEUE_QUERY_IDX has a value of 3 meaning the array has a total size of 19. Since accesses to "struct stats_query_entry query" are offset-ted by BNX2X_FIRST_QUEUE_QUERY_IDX, that means that the total number of Ethernet queues should not exceed FP_SB_MAX_E1x (16). However one of these queues is reserved for FCOE and thus the number of Ethernet queues should be set to [FP_SB_MAX_E1x -1] (15) if FCOE is enabled or [FP_SB_MAX_E1x] (16) if it is not. This is also described in a comment in the source code in drivers/net/ethernet/broadcom/bnx2x/bnx2x.h just above the Macro definition of FP_SB_MAX_E1x. Below is the part of this explanation that it important for this patch /* * The total number of L2 queues, MSIX vectors and HW contexts (CIDs) is * control by the number of fast-path status blocks supported by the * device (HW/FW). Each fast-path status block (FP-SB) aka non-default * status block represents an independent interrupts context that can * serve a regular L2 networking queue. However special L2 queues such * as the FCoE queue do not require a FP-SB and other components like * the CNIC may consume FP-SB reducing the number of possible L2 queues * * If the maximum number of FP-SB available is X then: * a. If CNIC is supported it consumes 1 FP-SB thus the max number of * regular L2 queues is Y=X-1 * b. In MF mode the actual number of L2 queues is Y= (X-1/MF_factor) * c. If the FCoE L2 queue is supported the actual number of L2 queues * is Y+1 * d. The number of irqs (MSIX vectors) is either Y+1 (one extra for * slow-path interrupts) or Y+2 if CNIC is supported (one additional * FP interrupt context for the CNIC). * e. The number of HW context (CID count) is always X or X+1 if FCoE * L2 queue is supported. The cid for the FCoE L2 queue is always X. */ However this driver also supports NICs that use the E2 controller which can handle more queues due to having more FP-SB represented by FP_SB_MAX_E2. Looking at the commits when the E2 support was added, it was originally using the E1x parameters: commit f2e0899f0f27 ("bnx2x: Add 57712 support"). Back then FP_SB_MAX_E2 was set to 16 the same as E1x. However the driver was later updated to take full advantage of the E2 instead of having it be limited to the capabilities of the E1x. But as far as we can tell, the array "stats_query_entry query" was still limited to using the FP-SB available to the E1x cards as part of an oversignt when the driver was updated to take full advantage of the E2, and now with the driver being aware of the greater queue size supported by E2 NICs, it causes the UBSAN warnings seen in the stack traces below. This patch increases the size of the "stats_query_entry query" array by replacing FP_SB_MAX_E1x with FP_SB_MAX_E2 to be large enough to handle both types of NICs. Stack traces: UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1529:11 index 20 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_prep_fw_stats_req+0x2e1/0x310 [bnx2x] bnx2x_stats_init+0x156/0x320 [bnx2x] bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x] bnx2x_nic_load+0x8e8/0x19e0 [bnx2x] bnx2x_open+0x16b/0x290 [bnx2x] __dev_open+0x10e/0x1d0 RIP: 0033:0x736223927a0a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003 RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0 R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00 </TASK> ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.c:1546:11 index 28 is out of range for type 'stats_query_entry [19]' CPU: 12 PID: 858 Comm: systemd-network Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_prep_fw_stats_req+0x2fd/0x310 [bnx2x] bnx2x_stats_init+0x156/0x320 [bnx2x] bnx2x_post_irq_nic_init+0x81/0x1a0 [bnx2x] bnx2x_nic_load+0x8e8/0x19e0 [bnx2x] bnx2x_open+0x16b/0x290 [bnx2x] __dev_open+0x10e/0x1d0 RIP: 0033:0x736223927a0a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc0bb2ada8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000583df50f9c78 RCX: 0000736223927a0a RDX: 0000000000000020 RSI: 0000583df50ee510 RDI: 0000000000000003 RBP: 0000583df50d4940 R08: 00007ffc0bb2adb0 R09: 0000000000000080 R10: 0000000000000000 R11: 0000000000000246 R12: 0000583df5103ae0 R13: 000000000000035a R14: 0000583df50f9c30 R15: 0000583ddddddf00 </TASK> ---[ end trace ]--- ------------[ cut here ]------------ UBSAN: array-index-out-of-bounds in drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1895:8 index 29 is out of range for type 'stats_query_entry [19]' CPU: 13 PID: 163 Comm: kworker/u96:1 Not tainted 6.9.0-060900rc7-generic #202405052133 Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 10/21/2019 Workqueue: bnx2x bnx2x_sp_task [bnx2x] Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 dump_stack+0x10/0x20 __ubsan_handle_out_of_bounds+0xcb/0x110 bnx2x_iov_adjust_stats_req+0x3c4/0x3d0 [bnx2x] bnx2x_storm_stats_post.part.0+0x4a/0x330 [bnx2x] ? bnx2x_hw_stats_post+0x231/0x250 [bnx2x] bnx2x_stats_start+0x44/0x70 [bnx2x] bnx2x_stats_handle+0x149/0x350 [bnx2x] bnx2x_attn_int_asserted+0x998/0x9b0 [bnx2x] bnx2x_sp_task+0x491/0x5c0 [bnx2x] process_one_work+0x18d/0x3f0 </TASK> ---[ end trace ]--- Fixes: 50f0a562f8cc ("bnx2x: add fcoe statistics") Signed-off-by: Ghadi Elie Rahme <ghadi.rahme(a)canonical.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20240627111405.1037812-1-ghadi.rahme@canonical.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h index 3db54b664aed..98a837819b65 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h @@ -1256,7 +1256,7 @@ enum { struct bnx2x_fw_stats_req { struct stats_query_header hdr; - struct stats_query_entry query[FP_SB_MAX_E1x+ + struct stats_query_entry query[FP_SB_MAX_E2 + BNX2X_FIRST_QUEUE_QUERY_IDX]; }; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: mt76: replace skb_put with skb_put_zero
by Wang Hai 08 Aug '24

08 Aug '24

From: Felix Fietkau <nbd(a)nbd.name> mainline inclusion from mainline-v6.10-rc1 commit 7f819a2f4fbc510e088b49c79addcf1734503578 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPSS CVE: CVE-2024-42225 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Avoid potentially reusing uninitialized data Signed-off-by: Felix Fietkau <nbd(a)nbd.name> Conflicts: drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c [commit d0e274af2f2e ("mt76: mt76_connac: create mcu library") is not merged resulting in a conflict] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 69691bf6197d..333a75e4a08c 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -724,7 +724,7 @@ mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len, .len = cpu_to_le16(sub_len), }; - ptlv = skb_put(skb, sub_len); + ptlv = skb_put_zero(skb, sub_len); memcpy(ptlv, &tlv, sizeof(tlv)); le16_add_cpu(sub_ntlv, 1); -- 2.17.1

2 1

[PATCH OLK-5.10] wifi: mt76: replace skb_put with skb_put_zero
by Wang Hai 08 Aug '24

08 Aug '24

From: Felix Fietkau <nbd(a)nbd.name> mainline inclusion from mainline-v6.10-rc1 commit 7f819a2f4fbc510e088b49c79addcf1734503578 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPSS CVE: CVE-2024-42225 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Avoid potentially reusing uninitialized data Signed-off-by: Felix Fietkau <nbd(a)nbd.name> Conflicts: drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c [commit d0e274af2f2e ("mt76: mt76_connac: create mcu library") is not merged resulting in a conflict] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 69691bf6197d..333a75e4a08c 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -724,7 +724,7 @@ mt7915_mcu_add_nested_subtlv(struct sk_buff *skb, int sub_tag, int sub_len, .len = cpu_to_le16(sub_len), }; - ptlv = skb_put(skb, sub_len); + ptlv = skb_put_zero(skb, sub_len); memcpy(ptlv, &tlv, sizeof(tlv)); le16_add_cpu(sub_ntlv, 1); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS v3] powerpc/pseries: Whitelist dtl slub object for copying to userspace
by zhangyinhua 08 Aug '24

08 Aug '24

From: Anjali K <anjalik(a)linux.ibm.com> stable inclusion from stable-v5.10.223 commit 6b16098148ea58a67430d90e20476be2377c3acd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELM CVE: CVE-2024-41065 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------------------------------------- [ Upstream commit 1a14150e1656f7a332a943154fc486504db4d586 ] Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as shown below. kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85 Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries NIP: c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8 REGS: c000000120c078c0 TRAP: 0700 Not tainted (6.10.0-rc3) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 2828220f XER: 0000000e CFAR: c0000000001fdc80 IRQMASK: 0 [ ... GPRs omitted ... ] NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0 LR [c0000000005d23d0] usercopy_abort+0x74/0xb0 Call Trace: usercopy_abort+0x74/0xb0 (unreliable) __check_heap_object+0xf8/0x120 check_heap_object+0x218/0x240 __check_object_size+0x84/0x1a4 dtl_file_read+0x17c/0x2c4 full_proxy_read+0x8c/0x110 vfs_read+0xdc/0x3a0 ksys_read+0x84/0x144 system_call_exception+0x124/0x330 system_call_vectored_common+0x15c/0x2ec --- interrupt: 3000 at 0x7fff81f3ab34 Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") requires that only whitelisted areas in slab/slub objects can be copied to userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. Dtl contains hypervisor dispatch events which are expected to be read by privileged users. Hence mark this safe for user access. Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the entire object. Co-developed-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Anjali K <anjalik(a)linux.ibm.com> Reviewed-by: Srikar Dronamraju <srikar(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240614173844.746818-1-anjalik@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/powerpc/platforms/pseries/setup.c [Resolve conflicts due to lack of d5394c059da9786043934bed474562cde124e7d3] Signed-off-by: zhangyinhua <zhangyinhua4(a)h-partners.com> --- arch/powerpc/platforms/pseries/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c index 2e0d38cafdd4..e4bf7ef4074b 100644 --- a/arch/powerpc/platforms/pseries/setup.c +++ b/arch/powerpc/platforms/pseries/setup.c @@ -309,8 +309,8 @@ static inline int alloc_dispatch_logs(void) static int alloc_dispatch_log_kmem_cache(void) { - dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES, - DISPATCH_LOG_BYTES, 0, NULL); + dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES, + DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, NULL); if (!dtl_cache) { pr_warn("Failed to create dispatch trace log buffer cache\n"); pr_warn("Stolen time statistics will be unreliable\n"); -- 2.34.1

2 1

[PATCH OLK-6.6 v2] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
by Yue Haibing 08 Aug '24

08 Aug '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.10-rc7 commit d1cba2ea8121e7fdbe1328cea782876b1dd80993 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGX1C CVE: CVE-2024-42114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31. We had a similar issue in sch_fq, fixed with commit d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM") watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24] Modules linked in: irq event stamp: 131135 hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline] hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95 hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline] softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553 softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: mld mld_ifc_work pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __list_del include/linux/list.h:195 [inline] pc : __list_del_entry include/linux/list.h:218 [inline] pc : list_move_tail include/linux/list.h:310 [inline] pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline] pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854 lr : __list_del_entry include/linux/list.h:218 [inline] lr : list_move_tail include/linux/list.h:310 [inline] lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline] lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854 sp : ffff800093d36700 x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000 x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0 x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0 x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0 x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8 x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470 Call trace: __list_del include/linux/list.h:195 [inline] __list_del_entry include/linux/list.h:218 [inline] list_move_tail include/linux/list.h:310 [inline] fq_tin_dequeue include/net/fq_impl.h:112 [inline] ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854 wake_tx_push_queue net/mac80211/util.c:294 [inline] ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315 drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline] schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline] ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664 ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966 ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062 __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338 ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547 __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341 dev_queue_xmit include/linux/netdevice.h:3091 [inline] neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137 ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:450 [inline] NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314 mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650 process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267 process_scheduled_works kernel/workqueue.c:3348 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:3429 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240615160800.250667-1-edumazet@google.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/wireless/nl80211.c [Yue: remove q_range static modifier for discarded-qualifiers warning] Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/wireless/nl80211.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 8f8f077e6cd4..685fbfe2047a 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -468,6 +468,10 @@ static struct netlink_range_validation nl80211_punct_bitmap_range = { .max = 0xffff, }; +static struct netlink_range_validation q_range = { + .max = INT_MAX, +}; + static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, @@ -750,7 +754,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, - [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, + [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), [NL80211_ATTR_HE_CAPABILITY] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa, NL80211_HE_MAX_CAPABILITY_LEN), -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v2] powerpc/pseries: Whitelist dtl slub object for copying to userspace
by zhangyinhua 08 Aug '24

08 Aug '24

From: Anjali K <anjalik(a)linux.ibm.com> stable inclusion from stable-v6.10.3 commit 1a14150e1656f7a332a943154fc486504db4d586 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELM CVE: CVE-2024-41065 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------------------------------------- Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as shown below. kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85 Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries NIP: c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8 REGS: c000000120c078c0 TRAP: 0700 Not tainted (6.10.0-rc3) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 2828220f XER: 0000000e CFAR: c0000000001fdc80 IRQMASK: 0 [ ... GPRs omitted ... ] NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0 LR [c0000000005d23d0] usercopy_abort+0x74/0xb0 Call Trace: usercopy_abort+0x74/0xb0 (unreliable) __check_heap_object+0xf8/0x120 check_heap_object+0x218/0x240 __check_object_size+0x84/0x1a4 dtl_file_read+0x17c/0x2c4 full_proxy_read+0x8c/0x110 vfs_read+0xdc/0x3a0 ksys_read+0x84/0x144 system_call_exception+0x124/0x330 system_call_vectored_common+0x15c/0x2ec --- interrupt: 3000 at 0x7fff81f3ab34 Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") requires that only whitelisted areas in slab/slub objects can be copied to userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. Dtl contains hypervisor dispatch events which are expected to be read by privileged users. Hence mark this safe for user access. Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the entire object. Co-developed-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Anjali K <anjalik(a)linux.ibm.com> Reviewed-by: Srikar Dronamraju <srikar(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240614173844.746818-1-anjalik@linux.ibm.com Conflicts: arch/powerpc/platforms/pseries/setup.c [Resolve conflict due to lack of d5394c059da9786043934bed474562cde124e7d3] Signed-off-by: zhangyinhua <zhangyinhua4(a)h-partners.com> --- arch/powerpc/platforms/pseries/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c index 2e0d38cafdd4..35ec6ed65bd1 100644 --- a/arch/powerpc/platforms/pseries/setup.c +++ b/arch/powerpc/platforms/pseries/setup.c @@ -309,8 +309,8 @@ static inline int alloc_dispatch_logs(void) static int alloc_dispatch_log_kmem_cache(void) { - dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES, - DISPATCH_LOG_BYTES, 0, NULL); + dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES, + DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, NULL); if (!dtl_cache) { pr_warn("Failed to create dispatch trace log buffer cache\n"); pr_warn("Stolen time statistics will be unreliable\n"); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] media: dvb-frontends: tda10048: Fix integer overflow
by Yi Yang 08 Aug '24

08 Aug '24

From: Ricardo Ribalda <ribalda(a)chromium.org> stable inclusion from stable-v5.10.222 commit e1ba22618758e95e09c9fd30c69ccce38edf94c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSNO CVE: CVE-2024-42223 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1aa1329a67cc214c3b7bd2a14d1301a795760b07 ] state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. Create a new 64 bit variable to hold the calculations. Link: https://lore.kernel.org/linux-media/20240429-fix-cocci-v3-25-3c4865f5a4b0@c… Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/media/dvb-frontends/tda10048.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/media/dvb-frontends/tda10048.c b/drivers/media/dvb-frontends/tda10048.c index d1d206ebdedd..fe626fccc7b7 100644 --- a/drivers/media/dvb-frontends/tda10048.c +++ b/drivers/media/dvb-frontends/tda10048.c @@ -410,6 +410,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) struct tda10048_config *config = &state->config; int i; u32 if_freq_khz; + u64 sample_freq; dprintk(1, "%s(bw = %d)\n", __func__, bw); @@ -451,9 +452,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor); /* Calculate the sample frequency */ - state->sample_freq = state->xtal_hz * (state->pll_mfactor + 45); - state->sample_freq /= (state->pll_nfactor + 1); - state->sample_freq /= (state->pll_pfactor + 4); + sample_freq = state->xtal_hz; + sample_freq *= state->pll_mfactor + 45; + do_div(sample_freq, state->pll_nfactor + 1); + do_div(sample_freq, state->pll_pfactor + 4); + state->sample_freq = sample_freq; dprintk(1, "- sample_freq = %d\n", state->sample_freq); /* Update the I/F */ -- 2.25.1

2 2

[PATCH OLK-5.10] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
by Yue Haibing 08 Aug '24

08 Aug '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.10-rc7 commit d1cba2ea8121e7fdbe1328cea782876b1dd80993 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGX1C CVE: CVE-2024-42114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31. We had a similar issue in sch_fq, fixed with commit d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM") watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24] Modules linked in: irq event stamp: 131135 hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline] hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95 hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline] softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553 softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: mld mld_ifc_work pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __list_del include/linux/list.h:195 [inline] pc : __list_del_entry include/linux/list.h:218 [inline] pc : list_move_tail include/linux/list.h:310 [inline] pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline] pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854 lr : __list_del_entry include/linux/list.h:218 [inline] lr : list_move_tail include/linux/list.h:310 [inline] lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline] lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854 sp : ffff800093d36700 x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000 x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0 x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0 x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0 x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8 x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470 Call trace: __list_del include/linux/list.h:195 [inline] __list_del_entry include/linux/list.h:218 [inline] list_move_tail include/linux/list.h:310 [inline] fq_tin_dequeue include/net/fq_impl.h:112 [inline] ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854 wake_tx_push_queue net/mac80211/util.c:294 [inline] ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315 drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline] schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline] ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664 ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966 ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062 __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338 ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547 __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341 dev_queue_xmit include/linux/netdevice.h:3091 [inline] neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137 ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:450 [inline] NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314 mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650 process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267 process_scheduled_works kernel/workqueue.c:3348 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:3429 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240615160800.250667-1-edumazet@google.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> [Context conflict as commit b27f07c50a73 and a3a20feb32a1 does not backported] Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/wireless/nl80211.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 8a7f0c8fba5e..8499836e76bf 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -403,6 +403,10 @@ nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + .len = IEEE80211_MAX_DATA_LEN } }; +static const struct netlink_range_validation q_range = { + .max = INT_MAX, +}; + static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, @@ -685,7 +689,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, - [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, + [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), [NL80211_ATTR_HE_CAPABILITY] = NLA_POLICY_RANGE(NLA_BINARY, NL80211_HE_MIN_CAPABILITY_LEN, -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
by Kaixiong Yu 08 Aug '24

08 Aug '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.222 commit 145faa3d03688cbb7bbaaecbd84c01539852942c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAH01A CVE: CVE-2024-42102 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 30139c702048f1097342a31302cbd3d478f50c63 upstream. Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in page units fit into 32-bits. This patch series makes sure this is true (see patch 2/2 for more details). This patch (of 2): This reverts commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78. The commit is broken in several ways. Firstly, the removed (u64) cast from the multiplication will introduce a multiplication overflow on 32-bit archs if wb_thresh * bg_thresh >= 1<<32 (which is actually common - the default settings with 4GB of RAM will trigger this). Secondly, the div64_u64() is unnecessarily expensive on 32-bit archs. We have div64_ul() in case we want to be safe & cheap. Thirdly, if dirty thresholds are larger than 1<<32 pages, then dirty balancing is going to blow up in many other spectacular ways anyway so trying to fix one possible overflow is just moot. Link: https://lkml.kernel.org/r/20240621144017.30993-1-jack@suse.cz Link: https://lkml.kernel.org/r/20240621144246.11148-1-jack@suse.cz Fixes: 9319b647902c ("mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again") Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-By: Zach O'Keefe <zokeefe(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index e969667e8d62..b72da123f242 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1519,7 +1519,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
by Yue Haibing 08 Aug '24

08 Aug '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.10-rc7 commit d1cba2ea8121e7fdbe1328cea782876b1dd80993 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGX1C CVE: CVE-2024-42114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31. We had a similar issue in sch_fq, fixed with commit d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM") watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24] Modules linked in: irq event stamp: 131135 hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline] hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95 hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline] softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553 softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: mld mld_ifc_work pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __list_del include/linux/list.h:195 [inline] pc : __list_del_entry include/linux/list.h:218 [inline] pc : list_move_tail include/linux/list.h:310 [inline] pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline] pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854 lr : __list_del_entry include/linux/list.h:218 [inline] lr : list_move_tail include/linux/list.h:310 [inline] lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline] lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854 sp : ffff800093d36700 x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000 x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0 x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0 x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0 x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8 x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470 Call trace: __list_del include/linux/list.h:195 [inline] __list_del_entry include/linux/list.h:218 [inline] list_move_tail include/linux/list.h:310 [inline] fq_tin_dequeue include/net/fq_impl.h:112 [inline] ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854 wake_tx_push_queue net/mac80211/util.c:294 [inline] ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315 drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline] schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline] ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664 ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966 ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062 __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338 ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547 __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341 dev_queue_xmit include/linux/netdevice.h:3091 [inline] neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137 ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:450 [inline] NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314 mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650 process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267 process_scheduled_works kernel/workqueue.c:3348 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:3429 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240615160800.250667-1-edumazet@google.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> [Context conflict as commit b27f07c50a73 and a3a20feb32a1 does not backported] Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/wireless/nl80211.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 8a7f0c8fba5e..8499836e76bf 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -403,6 +403,10 @@ nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + .len = IEEE80211_MAX_DATA_LEN } }; +static const struct netlink_range_validation q_range = { + .max = INT_MAX, +}; + static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, @@ -685,7 +689,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, - [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, + [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), [NL80211_ATTR_HE_CAPABILITY] = NLA_POLICY_RANGE(NLA_BINARY, NL80211_HE_MIN_CAPABILITY_LEN, -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-42095
by felix 08 Aug '24

08 Aug '24

From: Felix Fu <fuzhen5(a)huawei.com> fix CVE-2024-42095 Udit Kumar (2): serial: 8250_omap: Implementation of Errata i2310 serial: 8250_omap: Fix Errata i2310 with RX FIFO level check drivers/tty/serial/8250/8250_omap.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
by Yue Haibing 08 Aug '24

08 Aug '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.10-rc7 commit d1cba2ea8121e7fdbe1328cea782876b1dd80993 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGX1C CVE: CVE-2024-42114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31. We had a similar issue in sch_fq, fixed with commit d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM") watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:0:24] Modules linked in: irq event stamp: 131135 hardirqs last enabled at (131134): [<ffff80008ae8778c>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline] hardirqs last enabled at (131134): [<ffff80008ae8778c>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95 hardirqs last disabled at (131135): [<ffff80008ae85378>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (131135): [<ffff80008ae85378>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_hh_init net/core/neighbour.c:1538 [inline] softirqs last enabled at (125892): [<ffff80008907e82c>] neigh_resolve_output+0x268/0x658 net/core/neighbour.c:1553 softirqs last disabled at (125896): [<ffff80008904166c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 CPU: 1 PID: 24 Comm: kworker/1:0 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: mld mld_ifc_work pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __list_del include/linux/list.h:195 [inline] pc : __list_del_entry include/linux/list.h:218 [inline] pc : list_move_tail include/linux/list.h:310 [inline] pc : fq_tin_dequeue include/net/fq_impl.h:112 [inline] pc : ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854 lr : __list_del_entry include/linux/list.h:218 [inline] lr : list_move_tail include/linux/list.h:310 [inline] lr : fq_tin_dequeue include/net/fq_impl.h:112 [inline] lr : ieee80211_tx_dequeue+0x67c/0x3b4c net/mac80211/tx.c:3854 sp : ffff800093d36700 x29: ffff800093d36a60 x28: ffff800093d36960 x27: dfff800000000000 x26: ffff0000d800ad50 x25: ffff0000d800abe0 x24: ffff0000d800abf0 x23: ffff0000e0032468 x22: ffff0000e00324d4 x21: ffff0000d800abf0 x20: ffff0000d800abf8 x19: ffff0000d800abf0 x18: ffff800093d363c0 x17: 000000000000d476 x16: ffff8000805519dc x15: ffff7000127a6cc8 x14: 1ffff000127a6cc8 x13: 0000000000000004 x12: ffffffffffffffff x11: ffff7000127a6cc8 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff80009287aa08 x4 : 0000000000000008 x3 : ffff80008034c7fc x2 : ffff0000e0032468 x1 : 00000000da0e46b8 x0 : ffff0000e0032470 Call trace: __list_del include/linux/list.h:195 [inline] __list_del_entry include/linux/list.h:218 [inline] list_move_tail include/linux/list.h:310 [inline] fq_tin_dequeue include/net/fq_impl.h:112 [inline] ieee80211_tx_dequeue+0x6b8/0x3b4c net/mac80211/tx.c:3854 wake_tx_push_queue net/mac80211/util.c:294 [inline] ieee80211_handle_wake_tx_queue+0x118/0x274 net/mac80211/util.c:315 drv_wake_tx_queue net/mac80211/driver-ops.h:1350 [inline] schedule_and_wake_txq net/mac80211/driver-ops.h:1357 [inline] ieee80211_queue_skb+0x18e8/0x2244 net/mac80211/tx.c:1664 ieee80211_tx+0x260/0x400 net/mac80211/tx.c:1966 ieee80211_xmit+0x278/0x354 net/mac80211/tx.c:2062 __ieee80211_subif_start_xmit+0xab8/0x122c net/mac80211/tx.c:4338 ieee80211_subif_start_xmit+0xe0/0x438 net/mac80211/tx.c:4532 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x27c/0x938 net/core/dev.c:3547 __dev_queue_xmit+0x1678/0x33fc net/core/dev.c:4341 dev_queue_xmit include/linux/netdevice.h:3091 [inline] neigh_resolve_output+0x558/0x658 net/core/neighbour.c:1563 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x104c/0x1ee8 net/ipv6/ip6_output.c:137 ip6_finish_output+0x428/0x7a0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x270/0x594 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:450 [inline] NF_HOOK+0x160/0x4f0 include/linux/netfilter.h:314 mld_sendpack+0x7b4/0x10f4 net/ipv6/mcast.c:1818 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x840/0xd0c net/ipv6/mcast.c:2650 process_one_work+0x7b8/0x15d4 kernel/workqueue.c:3267 process_scheduled_works kernel/workqueue.c:3348 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:3429 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Fixes: 52539ca89f36 ("cfg80211: Expose TXQ stats and parameters to userspace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240615160800.250667-1-edumazet@google.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/wireless/nl80211.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 8f8f077e6cd4..969983944ac1 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -468,6 +468,10 @@ static struct netlink_range_validation nl80211_punct_bitmap_range = { .max = 0xffff, }; +static const struct netlink_range_validation q_range = { + .max = INT_MAX, +}; + static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD }, [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, @@ -750,7 +754,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, - [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, + [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range), [NL80211_ATTR_HE_CAPABILITY] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa, NL80211_HE_MAX_CAPABILITY_LEN), -- 2.34.1

2 3

[PATCH OLK-5.10] Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
by Kaixiong Yu 08 Aug '24

08 Aug '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.222 commit 145faa3d03688cbb7bbaaecbd84c01539852942c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAH01A CVE: CVE-2024-42102 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 30139c702048f1097342a31302cbd3d478f50c63 upstream. Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in page units fit into 32-bits. This patch series makes sure this is true (see patch 2/2 for more details). This patch (of 2): This reverts commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78. The commit is broken in several ways. Firstly, the removed (u64) cast from the multiplication will introduce a multiplication overflow on 32-bit archs if wb_thresh * bg_thresh >= 1<<32 (which is actually common - the default settings with 4GB of RAM will trigger this). Secondly, the div64_u64() is unnecessarily expensive on 32-bit archs. We have div64_ul() in case we want to be safe & cheap. Thirdly, if dirty thresholds are larger than 1<<32 pages, then dirty balancing is going to blow up in many other spectacular ways anyway so trying to fix one possible overflow is just moot. Link: https://lkml.kernel.org/r/20240621144017.30993-1-jack@suse.cz Link: https://lkml.kernel.org/r/20240621144246.11148-1-jack@suse.cz Fixes: 9319b647902c ("mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again") Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-By: Zach O'Keefe <zokeefe(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index e969667e8d62..b72da123f242 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1519,7 +1519,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
by Kaixiong Yu 08 Aug '24

08 Aug '24

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v4.19.318 commit 253f9ea7e8e53a5176bd80ceb174907b10724c1a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAH01A CVE: CVE-2024-42102 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 30139c702048f1097342a31302cbd3d478f50c63 upstream. Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in page units fit into 32-bits. This patch series makes sure this is true (see patch 2/2 for more details). This patch (of 2): This reverts commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78. The commit is broken in several ways. Firstly, the removed (u64) cast from the multiplication will introduce a multiplication overflow on 32-bit archs if wb_thresh * bg_thresh >= 1<<32 (which is actually common - the default settings with 4GB of RAM will trigger this). Secondly, the div64_u64() is unnecessarily expensive on 32-bit archs. We have div64_ul() in case we want to be safe & cheap. Thirdly, if dirty thresholds are larger than 1<<32 pages, then dirty balancing is going to blow up in many other spectacular ways anyway so trying to fix one possible overflow is just moot. Link: https://lkml.kernel.org/r/20240621144017.30993-1-jack@suse.cz Link: https://lkml.kernel.org/r/20240621144246.11148-1-jack@suse.cz Fixes: 9319b647902c ("mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again") Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-By: Zach O'Keefe <zokeefe(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/page-writeback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index 9bdcae34e39c..43e83930ce44 100644 --- a/mm/page-writeback.c +++ b/mm/page-writeback.c @@ -1529,7 +1529,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc) */ dtc->wb_thresh = __wb_calc_thresh(dtc); dtc->wb_bg_thresh = dtc->thresh ? - div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; + div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0; /* * In order to avoid the stacked BDI deadlock we need -- 2.25.1

2 3

[PATCH OLK-6.6] dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
by Liu Shixin 08 Aug '24

08 Aug '24

From: Li RongQing <lirongqing(a)baidu.com> stable inclusion from stable-v6.6.36 commit faa35db78b058a2ab6e074ee283f69fa398c36a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACZX7 CVE: CVE-2024-40956 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e3215deca4520773cd2b155bed164c12365149a7 ] Use list_for_each_entry_safe() to allow iterating through the list and deleting the entry in the iteration process. The descriptor is freed via idxd_desc_complete() and there's a slight chance may cause issue for the list iterator when the descriptor is reused by another thread without it being deleted from the list. Fixes: 16e19e11228b ("dmaengine: idxd: Fix list corruption in description completion") Signed-off-by: Li RongQing <lirongqing(a)baidu.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Reviewed-by: Fenghua Yu <fenghua.yu(a)intel.com> Link: https://lore.kernel.org/r/20240603012444.11902-1-lirongqing@baidu.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/dma/idxd/irq.c [ Context conflicts due to commit f3070b9b5661 ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/dma/idxd/irq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c index 8dc029c86551..fc049c9c9892 100644 --- a/drivers/dma/idxd/irq.c +++ b/drivers/dma/idxd/irq.c @@ -611,11 +611,13 @@ static void irq_process_work_list(struct idxd_irq_entry *irq_entry) spin_unlock(&irq_entry->list_lock); - list_for_each_entry(desc, &flist, list) { + list_for_each_entry_safe(desc, n, &flist, list) { /* * Check against the original status as ABORT is software defined * and 0xff, which DSA_COMP_STATUS_MASK can mask out. */ + list_del(&desc->list); + if (unlikely(desc->completion->status == IDXD_COMP_DESC_ABORT)) { idxd_desc_complete(desc, IDXD_COMPLETE_ABORT, true); continue; -- 2.25.1

2 1

[PATCH OLK-6.6] mm/userfaultfd: reset ptes when close() for wr-protected ones
by Liu Shixin 08 Aug '24

08 Aug '24

From: Peter Xu <peterx(a)redhat.com> stable inclusion from stable-v6.6.31 commit 377f3a9a3d032a52325a5b110379a25dd1ab1931 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9UOJV CVE: CVE-2024-36881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c88033efe9a391e72ba6b5df4b01d6e628f4e734 upstream. Userfaultfd unregister includes a step to remove wr-protect bits from all the relevant pgtable entries, but that only covered an explicit UFFDIO_UNREGISTER ioctl, not a close() on the userfaultfd itself. Cover that too. This fixes a WARN trace. The only user visible side effect is the user can observe leftover wr-protect bits even if the user close()ed on an userfaultfd when releasing the last reference of it. However hopefully that should be harmless, and nothing bad should happen even if so. This change is now more important after the recent page-table-check patch we merged in mm-unstable (446dd9ad37d0 ("mm/page_table_check: support userfault wr-protect entries")), as we'll do sanity check on uffd-wp bits without vma context. So it's better if we can 100% guarantee no uffd-wp bit leftovers, to make sure each report will be valid. Link: https://lore.kernel.org/all/000000000000ca4df20616a0fe16@google.com/ Fixes: f369b07c8614 ("mm/uffd: reset write protection when unregister with wp-mode") Analyzed-by: David Hildenbrand <david(a)redhat.com> Link: https://lkml.kernel.org/r/20240422133311.2987675-1-peterx@redhat.com Reported-by: syzbot+d8426b591c36b21c750e(a)syzkaller.appspotmail.com Signed-off-by: Peter Xu <peterx(a)redhat.com> Reviewed-by: David Hildenbrand <david(a)redhat.com> Cc: Nadav Amit <nadav.amit(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/userfaultfd.c [ Context conflicts due to commit b54b55c3305c ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- fs/userfaultfd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 232f12b4bc0a..e7cb9d70cad9 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -939,6 +939,10 @@ static int userfaultfd_release(struct inode *inode, struct file *file) prev = vma; continue; } + /* Reset ptes for the whole vma range if wr-protected */ + if (userfaultfd_wp(vma)) + uffd_wp_range(vma, vma->vm_start, + vma->vm_end - vma->vm_start, false); new_flags = vma->vm_flags & ~(__VM_UFFD_FLAGS | VM_USWAP); prev = vma_merge(&vmi, mm, prev, vma->vm_start, vma->vm_end, new_flags, vma->anon_vma, -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] powerpc/pseries: Whitelist dtl slub object for copying to userspace
by zhangyinhua 08 Aug '24

08 Aug '24

From: Anjali K <anjalik(a)linux.ibm.com> stable inclusion from stable-v5.10.223 commit 6b16098148ea58a67430d90e20476be2377c3acd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELM CVE: CVE-2024-41065 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------------------------------------- [ Upstream commit 1a14150e1656f7a332a943154fc486504db4d586 ] Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as shown below. kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85 Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries NIP: c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8 REGS: c000000120c078c0 TRAP: 0700 Not tainted (6.10.0-rc3) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 2828220f XER: 0000000e CFAR: c0000000001fdc80 IRQMASK: 0 [ ... GPRs omitted ... ] NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0 LR [c0000000005d23d0] usercopy_abort+0x74/0xb0 Call Trace: usercopy_abort+0x74/0xb0 (unreliable) __check_heap_object+0xf8/0x120 check_heap_object+0x218/0x240 __check_object_size+0x84/0x1a4 dtl_file_read+0x17c/0x2c4 full_proxy_read+0x8c/0x110 vfs_read+0xdc/0x3a0 ksys_read+0x84/0x144 system_call_exception+0x124/0x330 system_call_vectored_common+0x15c/0x2ec --- interrupt: 3000 at 0x7fff81f3ab34 Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") requires that only whitelisted areas in slab/slub objects can be copied to userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. Dtl contains hypervisor dispatch events which are expected to be read by privileged users. Hence mark this safe for user access. Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the entire object. Co-developed-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Anjali K <anjalik(a)linux.ibm.com> Reviewed-by: Srikar Dronamraju <srikar(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240614173844.746818-1-anjalik@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: zhangyinhua <zhangyinhua4(a)h-partners.com> --- arch/powerpc/platforms/pseries/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c index 0eac9ca782c2..1ca13369f31c 100644 --- a/arch/powerpc/platforms/pseries/setup.c +++ b/arch/powerpc/platforms/pseries/setup.c @@ -312,8 +312,8 @@ static int alloc_dispatch_log_kmem_cache(void) { void (*ctor)(void *) = get_dtl_cache_ctor(); - dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES, - DISPATCH_LOG_BYTES, 0, ctor); + dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES, + DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, ctor); if (!dtl_cache) { pr_warn("Failed to create dispatch trace log buffer cache\n"); pr_warn("Stolen time statistics will be unreliable\n"); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] powerpc/pseries: Whitelist dtl slub object for copying to userspace
by zhangyinhua 08 Aug '24

08 Aug '24

From: Anjali K <anjalik(a)linux.ibm.com> stable inclusion from stable-v6.10-rc7 commit 1a14150e1656f7a332a943154fc486504db4d586 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELM CVE: CVE-2024-41065 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------------------------------------- Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as shown below. kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85 Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries NIP: c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8 REGS: c000000120c078c0 TRAP: 0700 Not tainted (6.10.0-rc3) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 2828220f XER: 0000000e CFAR: c0000000001fdc80 IRQMASK: 0 [ ... GPRs omitted ... ] NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0 LR [c0000000005d23d0] usercopy_abort+0x74/0xb0 Call Trace: usercopy_abort+0x74/0xb0 (unreliable) __check_heap_object+0xf8/0x120 check_heap_object+0x218/0x240 __check_object_size+0x84/0x1a4 dtl_file_read+0x17c/0x2c4 full_proxy_read+0x8c/0x110 vfs_read+0xdc/0x3a0 ksys_read+0x84/0x144 system_call_exception+0x124/0x330 system_call_vectored_common+0x15c/0x2ec --- interrupt: 3000 at 0x7fff81f3ab34 Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") requires that only whitelisted areas in slab/slub objects can be copied to userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. Dtl contains hypervisor dispatch events which are expected to be read by privileged users. Hence mark this safe for user access. Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the entire object. Co-developed-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Anjali K <anjalik(a)linux.ibm.com> Reviewed-by: Srikar Dronamraju <srikar(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240614173844.746818-1-anjalik@linux.ibm.com Conflicts: arch/powerpc/platforms/pseries/setup.c [Resolve conflict due to lack of d5394c059da9786043934bed474562cde124e7d3] Signed-off-by: zhangyinhua <zhangyinhua4(a)h-partners.com> --- arch/powerpc/platforms/pseries/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c index 2e0d38cafdd4..35ec6ed65bd1 100644 --- a/arch/powerpc/platforms/pseries/setup.c +++ b/arch/powerpc/platforms/pseries/setup.c @@ -309,8 +309,8 @@ static inline int alloc_dispatch_logs(void) static int alloc_dispatch_log_kmem_cache(void) { - dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES, - DISPATCH_LOG_BYTES, 0, NULL); + dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES, + DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, NULL); if (!dtl_cache) { pr_warn("Failed to create dispatch trace log buffer cache\n"); pr_warn("Stolen time statistics will be unreliable\n"); -- 2.34.1

2 1

[PATCH OLK-5.10] powerpc/pseries: Whitelist dtl slub object for copying to userspace
by zhangyinhua 08 Aug '24

08 Aug '24

From: Anjali K <anjalik(a)linux.ibm.com> stable inclusion from stable-v5.10.223 commit 6b16098148ea58a67430d90e20476be2377c3acd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELM CVE: CVE-2024-41065 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------------------------------------- [ Upstream commit 1a14150e1656f7a332a943154fc486504db4d586 ] Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as shown below. kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85 Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries NIP: c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8 REGS: c000000120c078c0 TRAP: 0700 Not tainted (6.10.0-rc3) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 2828220f XER: 0000000e CFAR: c0000000001fdc80 IRQMASK: 0 [ ... GPRs omitted ... ] NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0 LR [c0000000005d23d0] usercopy_abort+0x74/0xb0 Call Trace: usercopy_abort+0x74/0xb0 (unreliable) __check_heap_object+0xf8/0x120 check_heap_object+0x218/0x240 __check_object_size+0x84/0x1a4 dtl_file_read+0x17c/0x2c4 full_proxy_read+0x8c/0x110 vfs_read+0xdc/0x3a0 ksys_read+0x84/0x144 system_call_exception+0x124/0x330 system_call_vectored_common+0x15c/0x2ec --- interrupt: 3000 at 0x7fff81f3ab34 Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") requires that only whitelisted areas in slab/slub objects can be copied to userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. Dtl contains hypervisor dispatch events which are expected to be read by privileged users. Hence mark this safe for user access. Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the entire object. Co-developed-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Anjali K <anjalik(a)linux.ibm.com> Reviewed-by: Srikar Dronamraju <srikar(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240614173844.746818-1-anjalik@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: zhangyinhua <zhangyinhua4(a)h-partners.com> --- arch/powerpc/platforms/pseries/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c index 822be2680b79..8e4a2e8aee11 100644 --- a/arch/powerpc/platforms/pseries/setup.c +++ b/arch/powerpc/platforms/pseries/setup.c @@ -312,8 +312,8 @@ static int alloc_dispatch_log_kmem_cache(void) { void (*ctor)(void *) = get_dtl_cache_ctor(); - dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES, - DISPATCH_LOG_BYTES, 0, ctor); + dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES, + DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, ctor); if (!dtl_cache) { pr_warn("Failed to create dispatch trace log buffer cache\n"); pr_warn("Stolen time statistics will be unreliable\n"); -- 2.34.1

2 1

[PATCH OLK-5.10] media: dvb-frontends: tda10048: Fix integer overflow
by Yi Yang 08 Aug '24

08 Aug '24

From: Ricardo Ribalda <ribalda(a)chromium.org> stable inclusion from stable-v5.10.222 commit e1ba22618758e95e09c9fd30c69ccce38edf94c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSNO CVE: CVE-2024-42223 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1aa1329a67cc214c3b7bd2a14d1301a795760b07 ] state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. Create a new 64 bit variable to hold the calculations. Link: https://lore.kernel.org/linux-media/20240429-fix-cocci-v3-25-3c4865f5a4b0@c… Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/media/dvb-frontends/tda10048.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/media/dvb-frontends/tda10048.c b/drivers/media/dvb-frontends/tda10048.c index d1d206ebdedd..fe626fccc7b7 100644 --- a/drivers/media/dvb-frontends/tda10048.c +++ b/drivers/media/dvb-frontends/tda10048.c @@ -410,6 +410,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) struct tda10048_config *config = &state->config; int i; u32 if_freq_khz; + u64 sample_freq; dprintk(1, "%s(bw = %d)\n", __func__, bw); @@ -451,9 +452,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor); /* Calculate the sample frequency */ - state->sample_freq = state->xtal_hz * (state->pll_mfactor + 45); - state->sample_freq /= (state->pll_nfactor + 1); - state->sample_freq /= (state->pll_pfactor + 4); + sample_freq = state->xtal_hz; + sample_freq *= state->pll_mfactor + 45; + do_div(sample_freq, state->pll_nfactor + 1); + do_div(sample_freq, state->pll_pfactor + 4); + state->sample_freq = sample_freq; dprintk(1, "- sample_freq = %d\n", state->sample_freq); /* Update the I/F */ -- 2.25.1

2 1

[PATCH OLK-6.6] sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
by Zheng Zucheng 08 Aug '24

08 Aug '24

mainline inclusion from mainline-v6.11-rc2 commit 77baa5bafcbe1b2a15ef9c37232c21279c95481c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAIN7J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In extreme test scenarios: the 14th field utime in /proc/xx/stat is greater than sum_exec_runtime, utime = 18446744073709518790 ns, rtime = 135989749728000 ns In cputime_adjust() process, stime is greater than rtime due to mul_u64_u64_div_u64() precision problem. before call mul_u64_u64_div_u64(), stime = 175136586720000, rtime = 135989749728000, utime = 1416780000. after call mul_u64_u64_div_u64(), stime = 135989949653530 unsigned reversion occurs because rtime is less than stime. utime = rtime - stime = 135989749728000 - 135989949653530 = -199925530 = (u64)18446744073709518790 Trigger condition: 1). User task run in kernel mode most of time 2). ARM64 architecture 3). TICK_CPU_ACCOUNTING=y CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set Fix mul_u64_u64_div_u64() conversion precision by reset stime to rtime Fixes: 3dc167ba5729 ("sched/cputime: Improve cputime_adjust()") Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: <stable(a)vger.kernel.org> Link: https://lkml.kernel.org/r/20240726023235.217771-1-zhengzucheng@huawei.com Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- kernel/sched/cputime.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index ca0eef7d3852..f03b3af2fb79 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -579,6 +579,12 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, } stime = mul_u64_u64_div_u64(stime, rtime, stime + utime); + /* + * Because mul_u64_u64_div_u64() can approximate on some + * achitectures; enforce the constraint that: a*b/(b+c) <= a. + */ + if (unlikely(stime > rtime)) + stime = rtime; update: /* -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
by Zheng Zucheng 08 Aug '24

08 Aug '24

mainline inclusion from mainline-v6.11-rc2 commit 77baa5bafcbe1b2a15ef9c37232c21279c95481c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAIN7D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In extreme test scenarios: the 14th field utime in /proc/xx/stat is greater than sum_exec_runtime, utime = 18446744073709518790 ns, rtime = 135989749728000 ns In cputime_adjust() process, stime is greater than rtime due to mul_u64_u64_div_u64() precision problem. before call mul_u64_u64_div_u64(), stime = 175136586720000, rtime = 135989749728000, utime = 1416780000. after call mul_u64_u64_div_u64(), stime = 135989949653530 unsigned reversion occurs because rtime is less than stime. utime = rtime - stime = 135989749728000 - 135989949653530 = -199925530 = (u64)18446744073709518790 Trigger condition: 1). User task run in kernel mode most of time 2). ARM64 architecture 3). TICK_CPU_ACCOUNTING=y CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set Fix mul_u64_u64_div_u64() conversion precision by reset stime to rtime Fixes: 3dc167ba5729 ("sched/cputime: Improve cputime_adjust()") Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: <stable(a)vger.kernel.org> Link: https://lkml.kernel.org/r/20240726023235.217771-1-zhengzucheng@huawei.com Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- kernel/sched/cputime.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index ca0eef7d3852..f03b3af2fb79 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -579,6 +579,12 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, } stime = mul_u64_u64_div_u64(stime, rtime, stime + utime); + /* + * Because mul_u64_u64_div_u64() can approximate on some + * achitectures; enforce the constraint that: a*b/(b+c) <= a. + */ + if (unlikely(stime > rtime)) + stime = rtime; update: /* -- 2.34.1

2 1

[PATCH OLK-5.10] sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
by Zheng Zucheng 08 Aug '24

08 Aug '24

mainline inclusion from mainline-v6.11-rc2 commit 77baa5bafcbe1b2a15ef9c37232c21279c95481c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAIN7D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In extreme test scenarios: the 14th field utime in /proc/xx/stat is greater than sum_exec_runtime, utime = 18446744073709518790 ns, rtime = 135989749728000 ns In cputime_adjust() process, stime is greater than rtime due to mul_u64_u64_div_u64() precision problem. before call mul_u64_u64_div_u64(), stime = 175136586720000, rtime = 135989749728000, utime = 1416780000. after call mul_u64_u64_div_u64(), stime = 135989949653530 unsigned reversion occurs because rtime is less than stime. utime = rtime - stime = 135989749728000 - 135989949653530 = -199925530 = (u64)18446744073709518790 Trigger condition: 1). User task run in kernel mode most of time 2). ARM64 architecture 3). TICK_CPU_ACCOUNTING=y CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set Fix mul_u64_u64_div_u64() conversion precision by reset stime to rtime Fixes: 3dc167ba5729 ("sched/cputime: Improve cputime_adjust()") Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: <stable(a)vger.kernel.org> Link: https://lkml.kernel.org/r/20240726023235.217771-1-zhengzucheng@huawei.com Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- kernel/sched/cputime.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index ca0eef7d3852..f03b3af2fb79 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -579,6 +579,12 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, } stime = mul_u64_u64_div_u64(stime, rtime, stime + utime); + /* + * Because mul_u64_u64_div_u64() can approximate on some + * achitectures; enforce the constraint that: a*b/(b+c) <= a. + */ + if (unlikely(stime > rtime)) + stime = rtime; update: /* -- 2.34.1

2 1

[PATCH OLK-6.6] powerpc/pseries: Whitelist dtl slub object for copying to userspace
by zhangyinhua 08 Aug '24

08 Aug '24

From: Anjali K <anjalik(a)linux.ibm.com> stable inclusion from stable-v6.6.42 commit e512a59b472684d8585125101ab03b86c2c1348a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGELM CVE: CVE-2024-41065 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------------------------------------- [ Upstream commit 1a14150e1656f7a332a943154fc486504db4d586 ] Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as shown below. kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85 Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries NIP: c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8 REGS: c000000120c078c0 TRAP: 0700 Not tainted (6.10.0-rc3) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 2828220f XER: 0000000e CFAR: c0000000001fdc80 IRQMASK: 0 [ ... GPRs omitted ... ] NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0 LR [c0000000005d23d0] usercopy_abort+0x74/0xb0 Call Trace: usercopy_abort+0x74/0xb0 (unreliable) __check_heap_object+0xf8/0x120 check_heap_object+0x218/0x240 __check_object_size+0x84/0x1a4 dtl_file_read+0x17c/0x2c4 full_proxy_read+0x8c/0x110 vfs_read+0xdc/0x3a0 ksys_read+0x84/0x144 system_call_exception+0x124/0x330 system_call_vectored_common+0x15c/0x2ec --- interrupt: 3000 at 0x7fff81f3ab34 Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") requires that only whitelisted areas in slab/slub objects can be copied to userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. Dtl contains hypervisor dispatch events which are expected to be read by privileged users. Hence mark this safe for user access. Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the entire object. Co-developed-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Vishal Chourasia <vishalc(a)linux.ibm.com> Signed-off-by: Anjali K <anjalik(a)linux.ibm.com> Reviewed-by: Srikar Dronamraju <srikar(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240614173844.746818-1-anjalik@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: zhangyinhua <zhangyinhua4(a)h-partners.com> --- arch/powerpc/platforms/pseries/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c index ad4d4d38e50a..1feb6b919bd9 100644 --- a/arch/powerpc/platforms/pseries/setup.c +++ b/arch/powerpc/platforms/pseries/setup.c @@ -343,8 +343,8 @@ static int alloc_dispatch_log_kmem_cache(void) { void (*ctor)(void *) = get_dtl_cache_ctor(); - dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES, - DISPATCH_LOG_BYTES, 0, ctor); + dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES, + DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, ctor); if (!dtl_cache) { pr_warn("Failed to create dispatch trace log buffer cache\n"); pr_warn("Stolen time statistics will be unreliable\n"); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] tcp_metrics: validate source addr length
by Yue Haibing 08 Aug '24

08 Aug '24

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v5.10.222 commit cdffc358717e436bb67122bb82c1a2a26e050f98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGRRM CVE: CVE-2024-42154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 66be40e622e177316ae81717aa30057ba9e61dff ] I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated). Reviewed-by: Eric Dumazet <edumazet(a)google.com> Fixes: 3e7013ddf55a ("tcp: metrics: Allow selective get/del of tcp-metrics based on src IP") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/ipv4/tcp_metrics.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c index f3ca6eea2ca3..935781227087 100644 --- a/net/ipv4/tcp_metrics.c +++ b/net/ipv4/tcp_metrics.c @@ -602,6 +602,7 @@ static const struct nla_policy tcp_metrics_nl_policy[TCP_METRICS_ATTR_MAX + 1] = [TCP_METRICS_ATTR_ADDR_IPV4] = { .type = NLA_U32, }, [TCP_METRICS_ATTR_ADDR_IPV6] = { .type = NLA_BINARY, .len = sizeof(struct in6_addr), }, + [TCP_METRICS_ATTR_SADDR_IPV4] = { .type = NLA_U32, }, /* Following attributes are not received for GET/DEL, * we keep them for reference */ -- 2.34.1

2 1

[PATCH OLK-5.10] tcp_metrics: validate source addr length
by Yue Haibing 08 Aug '24

08 Aug '24

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v5.10.222 commit cdffc358717e436bb67122bb82c1a2a26e050f98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGRRM CVE: CVE-2024-42154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 66be40e622e177316ae81717aa30057ba9e61dff ] I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated). Reviewed-by: Eric Dumazet <edumazet(a)google.com> Fixes: 3e7013ddf55a ("tcp: metrics: Allow selective get/del of tcp-metrics based on src IP") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/ipv4/tcp_metrics.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c index f3ca6eea2ca3..935781227087 100644 --- a/net/ipv4/tcp_metrics.c +++ b/net/ipv4/tcp_metrics.c @@ -602,6 +602,7 @@ static const struct nla_policy tcp_metrics_nl_policy[TCP_METRICS_ATTR_MAX + 1] = [TCP_METRICS_ATTR_ADDR_IPV4] = { .type = NLA_U32, }, [TCP_METRICS_ATTR_ADDR_IPV6] = { .type = NLA_BINARY, .len = sizeof(struct in6_addr), }, + [TCP_METRICS_ATTR_SADDR_IPV4] = { .type = NLA_U32, }, /* Following attributes are not received for GET/DEL, * we keep them for reference */ -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
by Yue Haibing 08 Aug '24

08 Aug '24

From: Nicolas Escande <nico.escande(a)gmail.com> stable inclusion from stable-v5.10.221 commit 7518e20a189f8659b8b83969db4d33a4068fcfc3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0PK CVE: CVE-2024-40942 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit b7d7f11a291830fdf69d3301075dd0fb347ced84 ] The hwmp code use objects of type mesh_preq_queue, added to a list in ieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath gets deleted, ex mesh interface is removed, the entries in that list will never get cleaned. Fix this by flushing all corresponding items of the preq_queue in mesh_path_flush_pending(). This should take care of KASAN reports like this: unreferenced object 0xffff00000668d800 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419552 (age 1836.444s) hex dump (first 32 bytes): 00 1f 05 09 00 00 ff ff 00 d5 68 06 00 00 ff ff ..........h..... 8e 97 ea eb 3e b8 01 00 00 00 00 00 00 00 00 00 ....>........... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 unreferenced object 0xffff000009051f00 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419553 (age 1836.440s) hex dump (first 32 bytes): 90 d6 92 0d 00 00 ff ff 00 d8 68 06 00 00 ff ff ..........h..... 36 27 92 e4 02 e0 01 00 00 58 79 06 00 00 ff ff 6'.......Xy..... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 Fixes: 050ac52cbe1f ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol") Signed-off-by: Nicolas Escande <nico.escande(a)gmail.com> Link: https://msgid.link/20240528142605.1060566-1-nico.escande@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/mac80211/mesh_pathtbl.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c index d936ef0c17a3..72ecce377d17 100644 --- a/net/mac80211/mesh_pathtbl.c +++ b/net/mac80211/mesh_pathtbl.c @@ -723,10 +723,23 @@ void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata, */ void mesh_path_flush_pending(struct mesh_path *mpath) { + struct ieee80211_sub_if_data *sdata = mpath->sdata; + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; + struct mesh_preq_queue *preq, *tmp; struct sk_buff *skb; while ((skb = skb_dequeue(&mpath->frame_queue)) != NULL) mesh_path_discard_frame(mpath->sdata, skb); + + spin_lock_bh(&ifmsh->mesh_preq_queue_lock); + list_for_each_entry_safe(preq, tmp, &ifmsh->preq_queue.list, list) { + if (ether_addr_equal(mpath->dst, preq->dst)) { + list_del(&preq->list); + kfree(preq); + --ifmsh->preq_queue_len; + } + } + spin_unlock_bh(&ifmsh->mesh_preq_queue_lock); } /** -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2024-42105
by Chen Ridong 08 Aug '24

08 Aug '24

*** BLURB HERE *** Ryusuke Konishi (1): nilfs2: fix inode number range checks fs/nilfs2/nilfs.h | 5 +++-- fs/nilfs2/the_nilfs.c | 6 ++++++ fs/nilfs2/the_nilfs.h | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
by Yue Haibing 08 Aug '24

08 Aug '24

From: Nicolas Escande <nico.escande(a)gmail.com> stable inclusion from stable-v5.10.221 commit 7518e20a189f8659b8b83969db4d33a4068fcfc3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0PK CVE: CVE-2024-40942 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit b7d7f11a291830fdf69d3301075dd0fb347ced84 ] The hwmp code use objects of type mesh_preq_queue, added to a list in ieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath gets deleted, ex mesh interface is removed, the entries in that list will never get cleaned. Fix this by flushing all corresponding items of the preq_queue in mesh_path_flush_pending(). This should take care of KASAN reports like this: unreferenced object 0xffff00000668d800 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419552 (age 1836.444s) hex dump (first 32 bytes): 00 1f 05 09 00 00 ff ff 00 d5 68 06 00 00 ff ff ..........h..... 8e 97 ea eb 3e b8 01 00 00 00 00 00 00 00 00 00 ....>........... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 unreferenced object 0xffff000009051f00 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419553 (age 1836.440s) hex dump (first 32 bytes): 90 d6 92 0d 00 00 ff ff 00 d8 68 06 00 00 ff ff ..........h..... 36 27 92 e4 02 e0 01 00 00 58 79 06 00 00 ff ff 6'.......Xy..... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 Fixes: 050ac52cbe1f ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol") Signed-off-by: Nicolas Escande <nico.escande(a)gmail.com> Link: https://msgid.link/20240528142605.1060566-1-nico.escande@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/mac80211/mesh_pathtbl.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c index d936ef0c17a3..72ecce377d17 100644 --- a/net/mac80211/mesh_pathtbl.c +++ b/net/mac80211/mesh_pathtbl.c @@ -723,10 +723,23 @@ void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata, */ void mesh_path_flush_pending(struct mesh_path *mpath) { + struct ieee80211_sub_if_data *sdata = mpath->sdata; + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; + struct mesh_preq_queue *preq, *tmp; struct sk_buff *skb; while ((skb = skb_dequeue(&mpath->frame_queue)) != NULL) mesh_path_discard_frame(mpath->sdata, skb); + + spin_lock_bh(&ifmsh->mesh_preq_queue_lock); + list_for_each_entry_safe(preq, tmp, &ifmsh->preq_queue.list, list) { + if (ether_addr_equal(mpath->dst, preq->dst)) { + list_del(&preq->list); + kfree(preq); + --ifmsh->preq_queue_len; + } + } + spin_unlock_bh(&ifmsh->mesh_preq_queue_lock); } /** -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tcp_metrics: validate source addr length
by Yue Haibing 08 Aug '24

08 Aug '24

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v4.19.318 commit 19d997b59fa1fd7a02e770ee0881c0652b9c32c9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGRRM CVE: CVE-2024-42154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 66be40e622e177316ae81717aa30057ba9e61dff ] I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated). Reviewed-by: Eric Dumazet <edumazet(a)google.com> Fixes: 3e7013ddf55a ("tcp: metrics: Allow selective get/del of tcp-metrics based on src IP") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/ipv4/tcp_metrics.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c index 60619b1f4acd..1bfbb8f8e0b7 100644 --- a/net/ipv4/tcp_metrics.c +++ b/net/ipv4/tcp_metrics.c @@ -624,6 +624,7 @@ static const struct nla_policy tcp_metrics_nl_policy[TCP_METRICS_ATTR_MAX + 1] = [TCP_METRICS_ATTR_ADDR_IPV4] = { .type = NLA_U32, }, [TCP_METRICS_ATTR_ADDR_IPV6] = { .type = NLA_BINARY, .len = sizeof(struct in6_addr), }, + [TCP_METRICS_ATTR_SADDR_IPV4] = { .type = NLA_U32, }, /* Following attributes are not received for GET/DEL, * we keep them for reference */ -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 4cb0169858cd0655e7998cf312142f76a0f5e63a
by kernel test robot 08 Aug '24

08 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4cb0169858cd0655e7998cf312142f76a0f5e63a !10761 leds: an30259a: Use devm_mutex_init() for mutex initialization elapsed time: 725m configs tested: 35 configs skipped: 137 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240807 gcc-14.1.0 arm64 randconfig-002-20240807 clang-17 arm64 randconfig-003-20240807 clang-15 arm64 randconfig-004-20240807 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240808 gcc-12 x86_64 buildonly-randconfig-002-20240808 gcc-12 x86_64 buildonly-randconfig-003-20240808 clang-18 x86_64 buildonly-randconfig-004-20240808 clang-18 x86_64 buildonly-randconfig-005-20240808 clang-18 x86_64 buildonly-randconfig-006-20240808 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240808 gcc-12 x86_64 randconfig-002-20240808 clang-18 x86_64 randconfig-003-20240808 gcc-12 x86_64 randconfig-004-20240808 clang-18 x86_64 randconfig-005-20240808 clang-18 x86_64 randconfig-006-20240808 clang-18 x86_64 randconfig-011-20240808 clang-18 x86_64 randconfig-012-20240808 gcc-12 x86_64 randconfig-013-20240808 gcc-12 x86_64 randconfig-014-20240808 clang-18 x86_64 randconfig-015-20240808 gcc-12 x86_64 randconfig-016-20240808 clang-18 x86_64 randconfig-071-20240808 clang-18 x86_64 randconfig-072-20240808 clang-18 x86_64 randconfig-073-20240808 clang-18 x86_64 randconfig-074-20240808 gcc-12 x86_64 randconfig-075-20240808 clang-18 x86_64 randconfig-076-20240808 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] dummy_struct_ops selftest failed
by Pu Lehui 08 Aug '24

08 Aug '24

Pu Lehui (2): Revert "[Backport] selftests/bpf: dummy_st_ops should reject 0 for non-nullable params" Revert "[Backport] selftests/bpf: adjust dummy_st_ops_success to detect additional error" .../selftests/bpf/prog_tests/dummy_st_ops.c | 27 ------------------- .../bpf/progs/dummy_st_ops_success.c | 13 ++------- 2 files changed, 2 insertions(+), 38 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS c84d316d6a7855966d34b7a68685020ba964419f
by kernel test robot 08 Aug '24

08 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: c84d316d6a7855966d34b7a68685020ba964419f !10700 ethernet: Fix error handling in xemaclite_of_probe Warning reports: https://lore.kernel.org/oe-kbuild-all/202408080045.jCIFyHQH-lkp@intel.com Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-001-20240807 | |-- include-linux-rbtree.h:warning:p-may-be-used-uninitialized | `-- include-linux-rbtree.h:warning:parent-may-be-used-uninitialized `-- x86_64-buildonly-randconfig-005-20240807 |-- drivers-net-ethernet-netswift-ngbe-.tmp_ngbe_lib.o:warning:objtool:missing-symbol-for-section-.text `-- drivers-net-ethernet-netswift-ngbe-.tmp_ngbe_sriov.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 726m configs tested: 34 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240807 gcc-14.1.0 arm64 randconfig-002-20240807 gcc-14.1.0 arm64 randconfig-003-20240807 gcc-14.1.0 arm64 randconfig-004-20240807 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240807 clang-18 x86_64 buildonly-randconfig-002-20240807 clang-18 x86_64 buildonly-randconfig-003-20240807 clang-18 x86_64 buildonly-randconfig-004-20240807 clang-18 x86_64 buildonly-randconfig-005-20240807 clang-18 x86_64 buildonly-randconfig-006-20240807 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240807 clang-18 x86_64 randconfig-002-20240807 gcc-12 x86_64 randconfig-003-20240807 clang-18 x86_64 randconfig-004-20240807 gcc-12 x86_64 randconfig-005-20240807 gcc-12 x86_64 randconfig-006-20240807 gcc-12 x86_64 randconfig-011-20240807 clang-18 x86_64 randconfig-012-20240807 gcc-12 x86_64 randconfig-013-20240807 gcc-12 x86_64 randconfig-014-20240807 gcc-12 x86_64 randconfig-015-20240807 clang-18 x86_64 randconfig-016-20240807 clang-18 x86_64 randconfig-071-20240807 clang-18 x86_64 randconfig-072-20240807 clang-18 x86_64 randconfig-073-20240807 gcc-12 x86_64 randconfig-074-20240807 clang-18 x86_64 randconfig-075-20240807 gcc-12 x86_64 randconfig-076-20240807 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f6c27c52d818e09203f05ffe8bfc2fe3f0b8a976
by kernel test robot 08 Aug '24

08 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f6c27c52d818e09203f05ffe8bfc2fe3f0b8a976 !10772 s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- arm64-randconfig-051-20240807 | |-- arch-arm64-boot-dts-qcom-sa8775p-ride.dtb:ethernet:Unevaluated-properties-are-not-allowed-(-dma-coherent-mdio-phy-handle-phy-mode-power-domains-rx-fifo-depth-rx-queues-config-snps-mtl-rx-config-snps-m | `-- arch-arm64-boot-dts-qcom-sa8775p-ride.dtb:ethernet:Unevaluated-properties-are-not-allowed-(-dma-coherent-phy-handle-phy-mode-power-domains-rx-fifo-depth-rx-queues-config-snps-mtl-rx-config-snps-mtl-tx |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-randconfig-001-20240807 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- loongarch-randconfig-002-20240807 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- x86_64-allyesconfig | `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device |-- x86_64-buildonly-randconfig-003-20240807 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-004-20240807 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-005-20240807 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus `-- x86_64-buildonly-randconfig-006-20240807 `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus elapsed time: 722m configs tested: 38 configs skipped: 124 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240807 gcc-14.1.0 arm64 randconfig-002-20240807 clang-17 arm64 randconfig-003-20240807 clang-15 arm64 randconfig-004-20240807 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240807 gcc-14.1.0 loongarch randconfig-002-20240807 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240807 clang-18 x86_64 buildonly-randconfig-002-20240807 clang-18 x86_64 buildonly-randconfig-003-20240807 clang-18 x86_64 buildonly-randconfig-004-20240807 clang-18 x86_64 buildonly-randconfig-005-20240807 clang-18 x86_64 buildonly-randconfig-006-20240807 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240807 clang-18 x86_64 randconfig-002-20240807 gcc-12 x86_64 randconfig-003-20240807 clang-18 x86_64 randconfig-004-20240807 gcc-12 x86_64 randconfig-005-20240807 gcc-12 x86_64 randconfig-006-20240807 gcc-12 x86_64 randconfig-011-20240807 clang-18 x86_64 randconfig-012-20240807 gcc-12 x86_64 randconfig-013-20240807 gcc-12 x86_64 randconfig-014-20240807 gcc-12 x86_64 randconfig-015-20240807 clang-18 x86_64 randconfig-016-20240807 clang-18 x86_64 randconfig-071-20240807 clang-18 x86_64 randconfig-072-20240807 clang-18 x86_64 randconfig-073-20240807 gcc-12 x86_64 randconfig-074-20240807 clang-18 x86_64 randconfig-075-20240807 gcc-12 x86_64 randconfig-076-20240807 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18554/23462] drivers/net/ethernet/netswift/ngbe/.tmp_ngbe_lib.o: warning: objtool: missing symbol for section .text
by kernel test robot 08 Aug '24

08 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c84d316d6a7855966d34b7a68685020ba964419f commit: 206f9c11a8c8b0197da5a26859d96d2ed65f5757 [18554/23462] net: ngbe: Add Netswift Giga NIC driver config: x86_64-buildonly-randconfig-005-20240807 (https://download.01.org/0day-ci/archive/20240808/202408080045.jCIFyHQH-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240808/202408080045.jCIFyHQH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408080045.jCIFyHQH-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/netswift/ngbe/ngbe_lib.c:19: drivers/net/ethernet/netswift/ngbe/ngbe.h:764:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^ 1 warning generated. >> drivers/net/ethernet/netswift/ngbe/.tmp_ngbe_lib.o: warning: objtool: missing symbol for section .text -- In file included from drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:30: drivers/net/ethernet/netswift/ngbe/ngbe.h:764:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^ 1 warning generated. >> drivers/net/ethernet/netswift/ngbe/.tmp_ngbe_sriov.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] s390/pkey: Wipe sensitive data on failure
by Peng Zhang 07 Aug '24

07 Aug '24

From: Holger Dengler <dengler(a)linux.ibm.com> mainline inclusion from mainline-v6.10-rc1 commit 1d8c270de5eb74245d72325d285894a577a945d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSLY CVE: CVE-2024-42157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------------------------------------- Wipe sensitive data from stack also if the copy_to_user() fails. Suggested-by: Heiko Carstens <hca(a)linux.ibm.com> Reviewed-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Ingo Franzki <ifranzki(a)linux.ibm.com> Acked-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Holger Dengler <dengler(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/s390/crypto/pkey_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c index b16344479959..fa97e666f19e 100644 --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1089,7 +1089,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (rc) break; if (copy_to_user(ucs, &kcs, sizeof(kcs))) - return -EFAULT; + rc = -EFAULT; memzero_explicit(&kcs, sizeof(kcs)); break; } @@ -1120,7 +1120,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (rc) break; if (copy_to_user(ucp, &kcp, sizeof(kcp))) - return -EFAULT; + rc = -EFAULT; memzero_explicit(&kcp, sizeof(kcp)); break; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: dvb-frontends: tda10048: Fix integer overflow
by Yi Yang 07 Aug '24

07 Aug '24

From: Ricardo Ribalda <ribalda(a)chromium.org> stable inclusion from stable-v4.19.318 commit 8167e4d7dc086d4f7ca7897dcff3827e4d22c99a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSNO CVE: CVE-2024-42223 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1aa1329a67cc214c3b7bd2a14d1301a795760b07 ] state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. Create a new 64 bit variable to hold the calculations. Link: https://lore.kernel.org/linux-media/20240429-fix-cocci-v3-25-3c4865f5a4b0@c… Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/media/dvb-frontends/tda10048.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/media/dvb-frontends/tda10048.c b/drivers/media/dvb-frontends/tda10048.c index c01d60a88af2..9e6a20fcac76 100644 --- a/drivers/media/dvb-frontends/tda10048.c +++ b/drivers/media/dvb-frontends/tda10048.c @@ -422,6 +422,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) struct tda10048_config *config = &state->config; int i; u32 if_freq_khz; + u64 sample_freq; dprintk(1, "%s(bw = %d)\n", __func__, bw); @@ -463,9 +464,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor); /* Calculate the sample frequency */ - state->sample_freq = state->xtal_hz * (state->pll_mfactor + 45); - state->sample_freq /= (state->pll_nfactor + 1); - state->sample_freq /= (state->pll_pfactor + 4); + sample_freq = state->xtal_hz; + sample_freq *= state->pll_mfactor + 45; + do_div(sample_freq, state->pll_nfactor + 1); + do_div(sample_freq, state->pll_pfactor + 4); + state->sample_freq = sample_freq; dprintk(1, "- sample_freq = %d\n", state->sample_freq); /* Update the I/F */ -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-42095
by felix 07 Aug '24

07 Aug '24

From: Felix Fu <fuzhen5(a)huawei.com> fix CVE-2024-42095 Udit Kumar (2): serial: 8250_omap: Implementation of Errata i2310 serial: 8250_omap: Fix Errata i2310 with RX FIFO level check drivers/tty/serial/8250/8250_omap.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-42095
by felix 07 Aug '24

07 Aug '24

From: Felix Fu <fuzhen5(a)huawei.com> fix CVE-2024-42095 Udit Kumar (2): serial: 8250_omap: Implementation of Errata i2310 serial: 8250_omap: Fix Errata i2310 with RX FIFO level check drivers/tty/serial/8250/8250_omap.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 21466/23457] drivers/scsi/hisi_raid/.tmp_hiraid_main.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 07 Aug '24

07 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 1b0fff4561341f470eaa556c2b1eb2131ce7ddc1 commit: f153a1e5e708c7cf9607ad375bf7145060ababd4 [21466/23457] SCSI: hisi_raid: support SPxxx serial RAID/HBA controllers config: x86_64-buildonly-randconfig-006-20240806 (https://download.01.org/0day-ci/archive/20240807/202408071520.YhKILcYe-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240807/202408071520.YhKILcYe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408071520.YhKILcYe-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/scsi/hisi_raid/hiraid_main.c:1851: warning: Function parameter or member 'hdev' not described in 'hiraid_create_complete_queue' drivers/scsi/hisi_raid/hiraid_main.c:1851: warning: Function parameter or member 'qid' not described in 'hiraid_create_complete_queue' drivers/scsi/hisi_raid/hiraid_main.c:1851: warning: Function parameter or member 'hiraidq' not described in 'hiraid_create_complete_queue' drivers/scsi/hisi_raid/hiraid_main.c:1851: warning: Function parameter or member 'cq_vector' not described in 'hiraid_create_complete_queue' drivers/scsi/hisi_raid/hiraid_main.c:1871: warning: Function parameter or member 'hdev' not described in 'hiraid_create_send_queue' drivers/scsi/hisi_raid/hiraid_main.c:1871: warning: Function parameter or member 'qid' not described in 'hiraid_create_send_queue' drivers/scsi/hisi_raid/hiraid_main.c:1871: warning: Function parameter or member 'hiraidq' not described in 'hiraid_create_send_queue' >> drivers/scsi/hisi_raid/.tmp_hiraid_main.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1] sched/fair: Scan cluster before scanning LLC in try_steal path
by Cheng Yu 07 Aug '24

07 Aug '24

If we enable the STEAL feature, when the newidle_balance fails, it will first find the busy CPU from the same smt, and then the same LLC. This patch makes the following modifications: the same cluster will be scanned before LLC. Thus, we can use more memory bandwidth. Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/fair.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 95d1841f8a20..2cc30fa158e5 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -13164,6 +13164,19 @@ static int try_steal(struct rq *dst_rq, struct rq_flags *dst_rf) } #endif /* CONFIG_SCHED_SMT */ +#ifdef CONFIG_SCHED_CLUSTER + /* + * Then try overloaded CPUs on the same cluster to preserve cache warmth further. + */ + for_each_cpu(src_cpu, cpu_clustergroup_mask(dst_cpu)) { + if (sparsemask_test_elem(overload_cpus, src_cpu) && + steal_from(dst_rq, dst_rf, &locked, src_cpu)) { + stolen = 1; + goto out; + } + } +#endif /* CONFIG_SCHED_CLUSTER */ + /* Accept any suitable task in the LLC */ sparsemask_for_each(overload_cpus, dst_cpu, src_cpu) { -- 2.25.1

2 1

[PATCH OLK-5.10] s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
by Zhang Changzhong 07 Aug '24

07 Aug '24

From: Jules Irenge <jbi.octave(a)gmail.com> mainline inclusion from mainline-v6.10-rc1 commit 22e6824622e8a8889df0f8fc4ed5aea0e702a694 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSJP CVE: CVE-2024-42158 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Replace memzero_explicit() and kfree() with kfree_sensitive() to fix warnings reported by Coccinelle: WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1506) WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1643) WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1770) Signed-off-by: Jules Irenge <jbi.octave(a)gmail.com> Reviewed-by: Holger Dengler <dengler(a)linux.ibm.com> Link: https://lore.kernel.org/r/ZjqZkNi_JUJu73Rg@octinomon.home Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Conflicts: drivers/s390/crypto/pkey_api.c [commit f370f45c6475 ("s390/pkey: do not use struct pkey_protkey") and 6d749b4e0208 ("s390/pkey: introduce dynamic debugging for pkey") are not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/s390/crypto/pkey_api.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c index 06b3d00..4a6a156 100644 --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1267,8 +1267,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, return PTR_ERR(kkey); rc = pkey_keyblob2pkey(kkey, ktp.keylen, &ktp.protkey); DEBUG_DBG("%s pkey_keyblob2pkey()=%d\n", __func__, rc); - memzero_explicit(kkey, ktp.keylen); - kfree(kkey); + kfree_sensitive(kkey); if (!rc && copy_to_user(utp, &ktp, sizeof(ktp))) rc = -EFAULT; memzero_explicit(&ktp, sizeof(ktp)); @@ -1400,8 +1399,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, kkey, ktp.keylen, &ktp.protkey); DEBUG_DBG("%s pkey_keyblob2pkey2()=%d\n", __func__, rc); kfree(apqns); - memzero_explicit(kkey, ktp.keylen); - kfree(kkey); + kfree_sensitive(kkey); if (!rc && copy_to_user(utp, &ktp, sizeof(ktp))) rc = -EFAULT; memzero_explicit(&ktp, sizeof(ktp)); @@ -1526,8 +1524,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, protkey, &protkeylen); DEBUG_DBG("%s pkey_keyblob2pkey3()=%d\n", __func__, rc); kfree(apqns); - memzero_explicit(kkey, ktp.keylen); - kfree(kkey); + kfree_sensitive(kkey); if (rc) { kfree_sensitive(protkey); break; -- 2.9.5

2 1

[openeuler:openEuler-1.0-LTS 12879/23451] drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 07 Aug '24

07 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 1b0fff4561341f470eaa556c2b1eb2131ce7ddc1 commit: c3088bd9bdf90fcfc8a69046692d75c2b04563ba [12879/23451] ath9k_htc: Discard undersized packets config: x86_64-randconfig-123-20240807 (https://download.01.org/0day-ci/archive/20240807/202408071233.HadVrNmN-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240807/202408071233.HadVrNmN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408071233.HadVrNmN-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] rs_datalen @@ got int @@ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: expected restricted __be16 [usertype] rs_datalen drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:987:20: sparse: got int >> drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:988:13: sparse: sparse: restricted __be16 degrades to integer drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1001:13: sparse: sparse: restricted __be16 degrades to integer In file included from drivers/net/wireless/ath/ath9k/htc.h:23, from drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:17: In function '__skb_queue_before', inlined from '__skb_queue_tail' at include/linux/skbuff.h:1886:2, inlined from 'ath9k_htc_tx_cleanup_queue' at drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:741:4: include/linux/skbuff.h:1852:9: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct sk_buff_head[1]' [-Warray-bounds] 1852 | __skb_insert(newsk, next->prev, next, list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c: In function 'ath9k_htc_tx_cleanup_queue': drivers/net/wireless/ath/ath9k/htc_drv_txrx.c:733:29: note: object 'queue' of size 96 733 | struct sk_buff_head queue; | ^~~~~ vim +987 drivers/net/wireless/ath/ath9k/htc_drv_txrx.c 962 963 static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, 964 struct ath9k_htc_rxbuf *rxbuf, 965 struct ieee80211_rx_status *rx_status) 966 967 { 968 struct ieee80211_hdr *hdr; 969 struct ieee80211_hw *hw = priv->hw; 970 struct sk_buff *skb = rxbuf->skb; 971 struct ath_common *common = ath9k_hw_common(priv->ah); 972 struct ath_hw *ah = common->ah; 973 struct ath_htc_rx_status *rxstatus; 974 struct ath_rx_status rx_stats; 975 bool decrypt_error = false; 976 __be16 rs_datalen; 977 bool is_phyerr; 978 979 if (skb->len < HTC_RX_FRAME_HEADER_SIZE) { 980 ath_err(common, "Corrupted RX frame, dropping (len: %d)\n", 981 skb->len); 982 goto rx_next; 983 } 984 985 rxstatus = (struct ath_htc_rx_status *)skb->data; 986 > 987 rs_datalen = be16_to_cpu(rxstatus->rs_datalen); > 988 if (unlikely(rs_datalen - 989 (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) { 990 ath_err(common, 991 "Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n", 992 rs_datalen, skb->len); 993 goto rx_next; 994 } 995 996 is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY; 997 /* 998 * Discard zero-length packets and packets smaller than an ACK 999 * which are not PHY_ERROR (short radar pulses have a length of 3) 1000 */ 1001 if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) { 1002 ath_warn(common, 1003 "Short RX data len, dropping (dlen: %d)\n", 1004 rs_datalen); 1005 goto rx_next; 1006 } 1007 1008 /* Get the RX status information */ 1009 1010 memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); 1011 1012 /* Copy everything from ath_htc_rx_status (HTC_RX_FRAME_HEADER). 1013 * After this, we can drop this part of skb. */ 1014 rx_status_htc_to_ath(&rx_stats, rxstatus); 1015 ath9k_htc_err_stat_rx(priv, &rx_stats); 1016 rx_status->mactime = be64_to_cpu(rxstatus->rs_tstamp); 1017 skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE); 1018 1019 /* 1020 * everything but the rate is checked here, the rate check is done 1021 * separately to avoid doing two lookups for a rate for each frame. 1022 */ 1023 hdr = (struct ieee80211_hdr *)skb->data; 1024 1025 /* 1026 * Process PHY errors and return so that the packet 1027 * can be dropped. 1028 */ 1029 if (unlikely(is_phyerr)) { 1030 /* TODO: Not using DFS processing now. */ 1031 if (ath_cmn_process_fft(&priv->spec_priv, hdr, 1032 &rx_stats, rx_status->mactime)) { 1033 /* TODO: Code to collect spectral scan statistics */ 1034 } 1035 goto rx_next; 1036 } 1037 1038 if (!ath9k_cmn_rx_accept(common, hdr, rx_status, &rx_stats, 1039 &decrypt_error, priv->rxfilter)) 1040 goto rx_next; 1041 1042 ath9k_cmn_rx_skb_postprocess(common, skb, &rx_stats, 1043 rx_status, decrypt_error); 1044 1045 if (ath9k_cmn_process_rate(common, hw, &rx_stats, rx_status)) 1046 goto rx_next; 1047 1048 rx_stats.is_mybeacon = ath_is_mybeacon(common, hdr); 1049 ath9k_cmn_process_rssi(common, hw, &rx_stats, rx_status); 1050 1051 rx_status->band = ah->curchan->chan->band; 1052 rx_status->freq = ah->curchan->chan->center_freq; 1053 rx_status->antenna = rx_stats.rs_antenna; 1054 rx_status->flag |= RX_FLAG_MACTIME_END; 1055 1056 return true; 1057 rx_next: 1058 return false; 1059 } 1060 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] Revert "ARM: spectre-v2: turn off the mitigation via boot cmdline param"
by felix 07 Aug '24

07 Aug '24

From: Felix Fu <fuzhen5(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAI881 CVE: NA ----------------------------------------- This reverts commit c54082777a606564eb8422368495915c8d22ff6d. Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- arch/arm/include/asm/system_misc.h | 1 - arch/arm/mm/proc-v7-bugs.c | 18 ------------------ arch/arm/mm/proc-v7.S | 9 --------- 3 files changed, 28 deletions(-) diff --git a/arch/arm/include/asm/system_misc.h b/arch/arm/include/asm/system_misc.h index 4ca02f1927f7..98b37340376b 100644 --- a/arch/arm/include/asm/system_misc.h +++ b/arch/arm/include/asm/system_misc.h @@ -36,7 +36,6 @@ static inline void harden_branch_predictor(void) #define UDBG_BUS (1 << 4) extern unsigned int user_debug; -extern int nospectre_v2; #endif /* !__ASSEMBLY__ */ diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c index b59c4d8ea762..8bc7a2d6d6c7 100644 --- a/arch/arm/mm/proc-v7-bugs.c +++ b/arch/arm/mm/proc-v7-bugs.c @@ -9,19 +9,6 @@ #include <asm/spectre.h> #include <asm/system_misc.h> -/* - * 32-bit ARM spectre hardening, enabled by default, can be disabled via boot - * cmdline param 'nospectre_v2' to avoid performance regression. - */ -int nospectre_v2 __read_mostly; - -static int __init nospectre_v2_setup(char *str) -{ - nospectre_v2 = 1; - return 0; -} -early_param("nospectre_v2", nospectre_v2_setup); - #ifdef CONFIG_ARM_PSCI static int __maybe_unused spectre_v2_get_cpu_fw_mitigation_state(void) { @@ -131,11 +118,6 @@ static void cpu_v7_spectre_v2_init(void) { unsigned int state, method = 0; - if (nospectre_v2) { - pr_info_once("Spectre v2: hardening is disabled\n"); - return; - } - switch (read_cpuid_part()) { case ARM_CPU_PART_CORTEX_A8: case ARM_CPU_PART_CORTEX_A9: diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S index d1bbbb5dae7d..193c7aeb6703 100644 --- a/arch/arm/mm/proc-v7.S +++ b/arch/arm/mm/proc-v7.S @@ -113,23 +113,14 @@ ENTRY(cpu_v7_hvc_switch_mm) b cpu_v7_switch_mm ENDPROC(cpu_v7_hvc_switch_mm) #endif - ENTRY(cpu_v7_iciallu_switch_mm) - ldr_l r3, nospectre_v2 - cmp r3, #1 - beq 1f mov r3, #0 mcr p15, 0, r3, c7, c5, 0 @ ICIALLU -1: b cpu_v7_switch_mm ENDPROC(cpu_v7_iciallu_switch_mm) ENTRY(cpu_v7_bpiall_switch_mm) - ldr_l r3, nospectre_v2 - cmp r3, #1 - beq 1f mov r3, #0 mcr p15, 0, r3, c7, c5, 6 @ flush BTAC/BTB -1: b cpu_v7_switch_mm ENDPROC(cpu_v7_bpiall_switch_mm) -- 2.34.1

2 1

[PATCH OLK-6.6] Revert "security: restrict init parameters by configuration"
by felix 07 Aug '24

07 Aug '24

From: Felix Fu <fuzhen5(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAI881 CVE: NA ----------------------------------------- This reverts commit e464994b10c4d427b458e16ac6b8b71aba5e2738. Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- init/main.c | 2 -- security/Kconfig | 6 ------ 2 files changed, 8 deletions(-) diff --git a/init/main.c b/init/main.c index 803332dd3d90..8fdfa69dba0f 100644 --- a/init/main.c +++ b/init/main.c @@ -574,7 +574,6 @@ static int __init unknown_bootoption(char *param, char *val, return 0; } -#ifndef CONFIG_SECURITY_BOOT_INIT static int __init init_setup(char *str) { unsigned int i; @@ -603,7 +602,6 @@ static int __init rdinit_setup(char *str) return 1; } __setup("rdinit=", rdinit_setup); -#endif #ifndef CONFIG_SMP static const unsigned int setup_max_cpus = NR_CPUS; diff --git a/security/Kconfig b/security/Kconfig index 9a6b9a115bb9..52c9af08ad35 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -249,11 +249,5 @@ config LSM source "security/Kconfig.hardening" -config SECURITY_BOOT_INIT - bool "Disable init & rdinit parameters in cmdline" - default n - help - No support init and rdinit parameters in cmdline - endmenu -- 2.34.1

2 1

[PATCH OLK-6.6 00/20] revert kaslr arm32 support
by felix 07 Aug '24

07 Aug '24

From: Felix Fu <fuzhen5(a)huawei.com> revert kaslr arm32 support Felix Fu (20): Revert "arm32: kaslr: Fix clock_gettime and gettimeofday performance degradation when configure CONFIG_RANDOMIZE_BASE" Revert "arm32: kaslr: Fix the bug of symbols relocation" Revert "arm32: kaslr: print kaslr offset when kernel panic" Revert "arm32: kaslr: pop visibility when compile decompress boot code as we need relocate BSS by GOT." Revert "arm32: kaslr: When boot with vxboot, we must adjust dtb address before kaslr_early_init, and store dtb address after init." Revert "No idea why this broke ..." Revert "ARM: decompressor: add KASLR support" Revert "ARM: decompressor: explicitly map decompressor binary cacheable" Revert "ARM: kernel: implement randomization of the kernel load address" Revert "arm: vectors: use local symbol names for vector entry points" Revert "ARM: kernel: refer to swapper_pg_dir via its symbol" Revert "ARM: mm: export default vmalloc base address" Revert "ARM: kernel: use PC relative symbol references in suspend/resume code" Revert "ARM: kernel: use PC-relative symbol references in MMU switch code" Revert "ARM: kernel: make vmlinux buildable as a PIE executable" Revert "ARM: kernel: switch to relative exception tables" Revert "arm-soc: various: replace open coded VA->PA calculation of pen_release" Revert "arm-soc: mvebu: replace open coded VA->PA conversion" Revert "arm-soc: exynos: replace open coded VA->PA conversions" Revert "asm-generic: add .data.rel.ro sections to __ro_after_init" arch/arm/Kconfig | 17 - arch/arm/Makefile | 7 - arch/arm/boot/compressed/Makefile | 17 +- arch/arm/boot/compressed/head.S | 139 +-------- arch/arm/boot/compressed/kaslr.c | 433 -------------------------- arch/arm/include/asm/Kbuild | 1 + arch/arm/include/asm/assembler.h | 22 +- arch/arm/include/asm/extable.h | 47 --- arch/arm/include/asm/futex.h | 6 +- arch/arm/include/asm/memory.h | 14 - arch/arm/include/asm/pgtable.h | 1 - arch/arm/include/asm/uaccess.h | 17 +- arch/arm/include/asm/vmlinux.lds.h | 13 +- arch/arm/include/asm/word-at-a-time.h | 6 +- arch/arm/kernel/entry-armv.S | 40 ++- arch/arm/kernel/fiq.c | 7 - arch/arm/kernel/head-common.S | 60 +++- arch/arm/kernel/head.S | 111 +------ arch/arm/kernel/setup.c | 31 -- arch/arm/kernel/sleep.S | 7 +- arch/arm/kernel/swp_emulate.c | 8 +- arch/arm/kernel/vmlinux.lds.S | 19 -- arch/arm/lib/backtrace.S | 13 +- arch/arm/lib/getuser.S | 24 +- arch/arm/lib/putuser.S | 15 +- arch/arm/mach-exynos/headsmp.S | 9 +- arch/arm/mach-exynos/sleep.S | 26 +- arch/arm/mach-mvebu/coherency_ll.S | 8 +- arch/arm/mach-spear/headsmp.S | 11 +- arch/arm/mach-versatile/headsmp.S | 9 +- arch/arm/mm/alignment.c | 24 +- arch/arm/mm/extable.c | 2 +- arch/arm/nwfpe/entry.S | 6 +- arch/arm/vdso/vgettimeofday.c | 5 - include/asm-generic/vmlinux.lds.h | 2 +- scripts/module.lds.S | 1 - scripts/sorttable.c | 2 +- 37 files changed, 243 insertions(+), 937 deletions(-) delete mode 100644 arch/arm/boot/compressed/kaslr.c delete mode 100644 arch/arm/include/asm/extable.h -- 2.34.1

2 21

[PATCH OLK-6.6] perf util: Add a function for replacing characters in a string
by Peng Zhang 07 Aug '24

07 Aug '24

From: James Clark <james.clark(a)arm.com> stable inclusion from stable-v6.6.33 commit 95e33c0f617b436436492d4fd0acdd5c0395071c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA74DQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8a55c1e2c9e123b399b272a7db23f09dbb74af21 upstream. It finds all occurrences of a single character and replaces them with a multi character string. This will be used in a test in a following commit. Reviewed-by: Ian Rogers <irogers(a)google.com> Signed-off-by: James Clark <james.clark(a)arm.com> Cc: Adrian Hunter <adrian.hunter(a)intel.com> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Chen Zhongjin <chenzhongjin(a)huawei.com> Cc: Eduard Zingerman <eddyz87(a)gmail.com> Cc: Haixin Yu <yuhaixin.yhx(a)linux.alibaba.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Jing Zhang <renyu.zj(a)linux.alibaba.com> Cc: Jiri Olsa <jolsa(a)kernel.org> Cc: John Garry <john.g.garry(a)oracle.com> Cc: Kajol Jain <kjain(a)linux.ibm.com> Cc: Kan Liang <kan.liang(a)linux.intel.com> Cc: Leo Yan <leo.yan(a)linaro.org> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Madhavan Srinivasan <maddy(a)linux.ibm.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mike Leach <mike.leach(a)linaro.org> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Ravi Bangoria <ravi.bangoria(a)amd.com> Cc: Will Deacon <will(a)kernel.org> Cc: Yang Jihong <yangjihong1(a)huawei.com> Cc: linux-arm-kernel(a)lists.infradead.org Link: https://lore.kernel.org/r/20230904095104.1162928-4-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: tools/perf/tests/Build [Context conflict] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- tools/perf/tests/Build | 1 + tools/perf/tests/builtin-test.c | 1 + tools/perf/tests/tests.h | 1 + tools/perf/tests/util.c | 31 +++++++++++++++++++++ tools/perf/util/string.c | 48 +++++++++++++++++++++++++++++++++ tools/perf/util/string2.h | 1 + 6 files changed, 83 insertions(+) create mode 100644 tools/perf/tests/util.c diff --git a/tools/perf/tests/Build b/tools/perf/tests/Build index 5b51f34b5bf3..29c065768a8b 100644 --- a/tools/perf/tests/Build +++ b/tools/perf/tests/Build @@ -66,6 +66,7 @@ perf-y += dlfilter-test.o perf-y += sigtrap.o perf-y += event_groups.o perf-y += symbols.o +perf-y += util.o ifeq ($(SRCARCH),$(filter $(SRCARCH),x86 arm arm64 powerpc sw_64)) perf-$(CONFIG_DWARF_UNWIND) += dwarf-unwind.o diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c index 0ad18cf6dd22..cb6f1dd00dc4 100644 --- a/tools/perf/tests/builtin-test.c +++ b/tools/perf/tests/builtin-test.c @@ -123,6 +123,7 @@ static struct test_suite *generic_tests[] = { &suite__sigtrap, &suite__event_groups, &suite__symbols, + &suite__util, NULL, }; diff --git a/tools/perf/tests/tests.h b/tools/perf/tests/tests.h index f33cfc3c19a4..b394f3ac2d66 100644 --- a/tools/perf/tests/tests.h +++ b/tools/perf/tests/tests.h @@ -145,6 +145,7 @@ DECLARE_SUITE(dlfilter); DECLARE_SUITE(sigtrap); DECLARE_SUITE(event_groups); DECLARE_SUITE(symbols); +DECLARE_SUITE(util); /* * PowerPC and S390 do not support creation of instruction breakpoints using the diff --git a/tools/perf/tests/util.c b/tools/perf/tests/util.c new file mode 100644 index 000000000000..6366db5cbf8c --- /dev/null +++ b/tools/perf/tests/util.c @@ -0,0 +1,31 @@ +// SPDX-License-Identifier: GPL-2.0 +#include "tests.h" +#include "util/debug.h" + +#include <linux/compiler.h> +#include <stdlib.h> +#include <string2.h> + +static int test_strreplace(char needle, const char *haystack, + const char *replace, const char *expected) +{ + char *new = strreplace_chars(needle, haystack, replace); + int ret = strcmp(new, expected); + + free(new); + return ret == 0; +} + +static int test__util(struct test_suite *t __maybe_unused, int subtest __maybe_unused) +{ + TEST_ASSERT_VAL("empty string", test_strreplace(' ', "", "123", "")); + TEST_ASSERT_VAL("no match", test_strreplace('5', "123", "4", "123")); + TEST_ASSERT_VAL("replace 1", test_strreplace('3', "123", "4", "124")); + TEST_ASSERT_VAL("replace 2", test_strreplace('a', "abcabc", "ef", "efbcefbc")); + TEST_ASSERT_VAL("replace long", test_strreplace('a', "abcabc", "longlong", + "longlongbclonglongbc")); + + return 0; +} + +DEFINE_SUITE("util", util); diff --git a/tools/perf/util/string.c b/tools/perf/util/string.c index cf05b0b56c57..116a642ad99d 100644 --- a/tools/perf/util/string.c +++ b/tools/perf/util/string.c @@ -301,3 +301,51 @@ unsigned int hex(char c) return c - 'a' + 10; return c - 'A' + 10; } + +/* + * Replace all occurrences of character 'needle' in string 'haystack' with + * string 'replace' + * + * The new string could be longer so a new string is returned which must be + * freed. + */ +char *strreplace_chars(char needle, const char *haystack, const char *replace) +{ + int replace_len = strlen(replace); + char *new_s, *to; + const char *loc = strchr(haystack, needle); + const char *from = haystack; + int num = 0; + + /* Count occurrences */ + while (loc) { + loc = strchr(loc + 1, needle); + num++; + } + + /* Allocate enough space for replacements and reset first location */ + new_s = malloc(strlen(haystack) + (num * (replace_len - 1) + 1)); + if (!new_s) + return NULL; + loc = strchr(haystack, needle); + to = new_s; + + while (loc) { + /* Copy original string up to found char and update positions */ + memcpy(to, from, 1 + loc - from); + to += loc - from; + from = loc + 1; + + /* Copy replacement string and update positions */ + memcpy(to, replace, replace_len); + to += replace_len; + + /* needle next occurrence or end of string */ + loc = strchr(from, needle); + } + + /* Copy any remaining chars + null */ + strcpy(to, from); + + return new_s; +} diff --git a/tools/perf/util/string2.h b/tools/perf/util/string2.h index 56c30fef9682..52cb8ba057c7 100644 --- a/tools/perf/util/string2.h +++ b/tools/perf/util/string2.h @@ -39,5 +39,6 @@ char *strpbrk_esc(char *str, const char *stopset); char *strdup_esc(const char *str); unsigned int hex(char c); +char *strreplace_chars(char needle, const char *haystack, const char *replace); #endif /* PERF_STRING_H */ -- 2.25.1

2 1

[PATCH OLK-6.6 00/20] *** revert arm32 kaslr support ***
by felix 07 Aug '24

07 Aug '24

From: Felix Fu <fuzhen5(a)huawei.com> *** revert arm32 kalsr support *** Felix Fu (20): Revert "arm32: kaslr: Fix clock_gettime and gettimeofday performance degradation when configure CONFIG_RANDOMIZE_BASE" Revert "arm32: kaslr: Fix the bug of symbols relocation" Revert "arm32: kaslr: print kaslr offset when kernel panic" Revert "arm32: kaslr: pop visibility when compile decompress boot code as we need relocate BSS by GOT." Revert "arm32: kaslr: When boot with vxboot, we must adjust dtb address before kaslr_early_init, and store dtb address after init." Revert "No idea why this broke ..." Revert "ARM: decompressor: add KASLR support" Revert "ARM: decompressor: explicitly map decompressor binary cacheable" Revert "ARM: kernel: implement randomization of the kernel load address" Revert "arm: vectors: use local symbol names for vector entry points" Revert "ARM: kernel: refer to swapper_pg_dir via its symbol" Revert "ARM: mm: export default vmalloc base address" Revert "ARM: kernel: use PC relative symbol references in suspend/resume code" Revert "ARM: kernel: use PC-relative symbol references in MMU switch code" Revert "ARM: kernel: make vmlinux buildable as a PIE executable" Revert "ARM: kernel: switch to relative exception tables" Revert "arm-soc: various: replace open coded VA->PA calculation of pen_release" Revert "arm-soc: mvebu: replace open coded VA->PA conversion" Revert "arm-soc: exynos: replace open coded VA->PA conversions" Revert "asm-generic: add .data.rel.ro sections to __ro_after_init" arch/arm/Kconfig | 17 - arch/arm/Makefile | 7 - arch/arm/boot/compressed/Makefile | 17 +- arch/arm/boot/compressed/head.S | 139 +-------- arch/arm/boot/compressed/kaslr.c | 433 -------------------------- arch/arm/include/asm/Kbuild | 1 + arch/arm/include/asm/assembler.h | 22 +- arch/arm/include/asm/extable.h | 47 --- arch/arm/include/asm/futex.h | 6 +- arch/arm/include/asm/memory.h | 14 - arch/arm/include/asm/pgtable.h | 1 - arch/arm/include/asm/uaccess.h | 17 +- arch/arm/include/asm/vmlinux.lds.h | 13 +- arch/arm/include/asm/word-at-a-time.h | 6 +- arch/arm/kernel/entry-armv.S | 40 ++- arch/arm/kernel/fiq.c | 7 - arch/arm/kernel/head-common.S | 60 +++- arch/arm/kernel/head.S | 111 +------ arch/arm/kernel/setup.c | 31 -- arch/arm/kernel/sleep.S | 7 +- arch/arm/kernel/swp_emulate.c | 8 +- arch/arm/kernel/vmlinux.lds.S | 19 -- arch/arm/lib/backtrace.S | 13 +- arch/arm/lib/getuser.S | 24 +- arch/arm/lib/putuser.S | 15 +- arch/arm/mach-exynos/headsmp.S | 9 +- arch/arm/mach-exynos/sleep.S | 26 +- arch/arm/mach-mvebu/coherency_ll.S | 8 +- arch/arm/mach-spear/headsmp.S | 11 +- arch/arm/mach-versatile/headsmp.S | 9 +- arch/arm/mm/alignment.c | 24 +- arch/arm/mm/extable.c | 2 +- arch/arm/nwfpe/entry.S | 6 +- arch/arm/vdso/vgettimeofday.c | 5 - include/asm-generic/vmlinux.lds.h | 2 +- scripts/module.lds.S | 1 - scripts/sorttable.c | 2 +- 37 files changed, 243 insertions(+), 937 deletions(-) delete mode 100644 arch/arm/boot/compressed/kaslr.c delete mode 100644 arch/arm/include/asm/extable.h -- 2.34.1

2 21

[openeuler:OLK-6.6] BUILD REGRESSION 2456f06dd16073ef1a16347cf6e8987740b992e5
by kernel test robot 07 Aug '24

07 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 2456f06dd16073ef1a16347cf6e8987740b992e5 !10635 nvme: avoid double free special payload Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- arm64-defconfig | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-051-20240806 | |-- arch-arm64-boot-dts-qcom-sa8775p-ride.dtb:ethernet:Unevaluated-properties-are-not-allowed-(-dma-coherent-mdio-phy-handle-phy-mode-power-domains-rx-fifo-depth-rx-queues-config-snps-mtl-rx-config-snps-m | `-- arch-arm64-boot-dts-qcom-sa8775p-ride.dtb:ethernet:Unevaluated-properties-are-not-allowed-(-dma-coherent-phy-handle-phy-mode-power-domains-rx-fifo-depth-rx-queues-config-snps-mtl-rx-config-snps-mtl-tx |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-defconfig | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-001-20240806 | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- x86_64-allyesconfig | `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device |-- x86_64-buildonly-randconfig-003-20240807 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-004-20240807 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-005-20240807 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus `-- x86_64-buildonly-randconfig-006-20240807 `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus elapsed time: 733m configs tested: 40 configs skipped: 134 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240806 clang-20 arm64 randconfig-002-20240806 clang-20 arm64 randconfig-003-20240806 clang-14 arm64 randconfig-004-20240806 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240806 gcc-14.1.0 loongarch randconfig-002-20240806 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240807 clang-18 x86_64 buildonly-randconfig-002-20240807 clang-18 x86_64 buildonly-randconfig-003-20240807 clang-18 x86_64 buildonly-randconfig-004-20240807 clang-18 x86_64 buildonly-randconfig-005-20240807 clang-18 x86_64 buildonly-randconfig-006-20240807 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240807 clang-18 x86_64 randconfig-002-20240807 gcc-12 x86_64 randconfig-003-20240807 clang-18 x86_64 randconfig-004-20240807 gcc-12 x86_64 randconfig-005-20240807 gcc-12 x86_64 randconfig-006-20240807 gcc-12 x86_64 randconfig-011-20240807 clang-18 x86_64 randconfig-012-20240807 gcc-12 x86_64 randconfig-013-20240807 gcc-12 x86_64 randconfig-014-20240807 gcc-12 x86_64 randconfig-015-20240807 clang-18 x86_64 randconfig-016-20240807 clang-18 x86_64 randconfig-071-20240807 clang-18 x86_64 randconfig-072-20240807 clang-18 x86_64 randconfig-073-20240807 gcc-12 x86_64 randconfig-074-20240807 clang-18 x86_64 randconfig-075-20240807 gcc-12 x86_64 randconfig-076-20240807 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] NFSD: Fix the behavior of READ near OFFSET_MAX
by Li Lingfeng 07 Aug '24

07 Aug '24

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v5.10.220 commit 1726a39b0879acfb490b22dca643f26f4f907da9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADG80 CVE: CVE-2022-48827 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960 ] Dan Aloni reports: > Due to commit 8cfb9015280d ("NFS: Always provide aligned buffers to > the RPC read layers") on the client, a read of 0xfff is aligned up > to server rsize of 0x1000. > > As a result, in a test where the server has a file of size > 0x7fffffffffffffff, and the client tries to read from the offset > 0x7ffffffffffff000, the read causes loff_t overflow in the server > and it returns an NFS code of EINVAL to the client. The client as > a result indefinitely retries the request. The Linux NFS client does not handle NFS?ERR_INVAL, even though all NFS specifications permit servers to return that status code for a READ. Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed and return a short result. Set the EOF flag in the result to prevent the client from retrying the READ request. This behavior appears to be consistent with Solaris NFS servers. Note that NFSv3 and NFSv4 use u64 offset values on the wire. These must be converted to loff_t internally before use -- an implicit type cast is not adequate for this purpose. Otherwise VFS checks against sb->s_maxbytes do not work properly. Reported-by: Dan Aloni <dan.aloni(a)vastdata.com> Cc: stable(a)vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nfsd/nfs3proc.c [Commit be63bd2ac6bb("NFSD: Update READ3arg decoder to use struct xdr_stream") modified the method of initializing resp->count] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs3proc.c | 8 ++++++-- fs/nfsd/nfs4proc.c | 8 ++++++-- fs/nfsd/nfs4xdr.c | 8 ++------ 3 files changed, 14 insertions(+), 10 deletions(-) diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c index 981a4e4c9a3c..0b61080d6234 100644 --- a/fs/nfsd/nfs3proc.c +++ b/fs/nfsd/nfs3proc.c @@ -145,18 +145,22 @@ nfsd3_proc_read(struct svc_rqst *rqstp) struct nfsd3_readargs *argp = rqstp->rq_argp; struct nfsd3_readres *resp = rqstp->rq_resp; u32 max_blocksize = svc_max_payload(rqstp); - unsigned long cnt = min(argp->count, max_blocksize); dprintk("nfsd: READ(3) %s %lu bytes at %Lu\n", SVCFH_fmt(&argp->fh), (unsigned long) argp->count, (unsigned long long) argp->offset); + argp->count = min_t(u32, argp->count, max_blocksize); + if (argp->offset > (u64)OFFSET_MAX) + argp->offset = (u64)OFFSET_MAX; + if (argp->offset + argp->count > (u64)OFFSET_MAX) + argp->count = (u64)OFFSET_MAX - argp->offset; /* Obtain buffer pointer for payload. * 1 (status) + 22 (post_op_attr) + 1 (count) + 1 (eof) * + 1 (xdr opaque byte count) = 26 */ - resp->count = cnt; + resp->count = argp->count; svc_reserve_auth(rqstp, ((1 + NFS3_POST_OP_ATTR_WORDS + 3)<<2) + resp->count +4); fh_copy(&resp->fh, &argp->fh); diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index e84996c3867c..41dc517c934f 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -772,12 +772,16 @@ nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, __be32 status; read->rd_nf = NULL; - if (read->rd_offset >= OFFSET_MAX) - return nfserr_inval; trace_nfsd_read_start(rqstp, &cstate->current_fh, read->rd_offset, read->rd_length); + read->rd_length = min_t(u32, read->rd_length, svc_max_payload(rqstp)); + if (read->rd_offset > (u64)OFFSET_MAX) + read->rd_offset = (u64)OFFSET_MAX; + if (read->rd_offset + read->rd_length > (u64)OFFSET_MAX) + read->rd_length = (u64)OFFSET_MAX - read->rd_offset; + /* * If we do a zero copy read, then a client will see read data * that reflects the state of the file *after* performing the diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index dbfa24cf3390..1c11042dafb8 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -3886,10 +3886,8 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr, } xdr_commit_encode(xdr); - maxcount = svc_max_payload(resp->rqstp); - maxcount = min_t(unsigned long, maxcount, + maxcount = min_t(unsigned long, read->rd_length, (xdr->buf->buflen - xdr->buf->len)); - maxcount = min_t(unsigned long, maxcount, read->rd_length); if (file->f_op->splice_read && test_bit(RQ_SPLICE_OK, &resp->rqstp->rq_flags)) @@ -4714,10 +4712,8 @@ nfsd4_encode_read_plus(struct nfsd4_compoundres *resp, __be32 nfserr, return nfserr_resource; xdr_commit_encode(xdr); - maxcount = svc_max_payload(resp->rqstp); - maxcount = min_t(unsigned long, maxcount, + maxcount = min_t(unsigned long, read->rd_length, (xdr->buf->buflen - xdr->buf->len)); - maxcount = min_t(unsigned long, maxcount, read->rd_length); count = maxcount; eof = read->rd_offset >= i_size_read(file_inode(file)); -- 2.31.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 6cfbe577edef769514bae08d5a28af236fd7c442
by kernel test robot 07 Aug '24

07 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 6cfbe577edef769514bae08d5a28af236fd7c442 !10742 irqchip/mbigen: Fix mbigen node address layout elapsed time: 724m configs tested: 35 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240806 clang-20 arm64 randconfig-002-20240806 clang-20 arm64 randconfig-003-20240806 clang-14 arm64 randconfig-004-20240806 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240806 clang-18 x86_64 buildonly-randconfig-002-20240806 clang-18 x86_64 buildonly-randconfig-003-20240806 clang-18 x86_64 buildonly-randconfig-004-20240806 clang-18 x86_64 buildonly-randconfig-005-20240806 gcc-12 x86_64 buildonly-randconfig-006-20240806 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240806 gcc-12 x86_64 randconfig-002-20240806 gcc-11 x86_64 randconfig-003-20240806 gcc-12 x86_64 randconfig-004-20240806 clang-18 x86_64 randconfig-005-20240806 clang-18 x86_64 randconfig-006-20240806 clang-18 x86_64 randconfig-011-20240806 gcc-12 x86_64 randconfig-012-20240806 gcc-12 x86_64 randconfig-013-20240806 clang-18 x86_64 randconfig-014-20240806 gcc-12 x86_64 randconfig-015-20240806 gcc-12 x86_64 randconfig-016-20240806 gcc-12 x86_64 randconfig-071-20240806 gcc-12 x86_64 randconfig-072-20240806 clang-18 x86_64 randconfig-073-20240806 gcc-11 x86_64 randconfig-074-20240806 gcc-12 x86_64 randconfig-075-20240806 gcc-12 x86_64 randconfig-076-20240806 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION b99509998bfe488900920c783664b4b4a70795da
by kernel test robot 07 Aug '24

07 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: b99509998bfe488900920c783664b4b4a70795da !10629 v2 hfsplus: fix uninit-value in copy_name Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202408062209.71Gj0prX-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202408062343.e6vm5gKl-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) ld: drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.o:drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c:50: multiple definition of `debug'; arch/x86/entry/entry_64.o:arch/x86/entry/entry_64.S:1094: first defined here Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-002-20240806 | |-- drivers-crypto-hisilicon-rde-rde_main.c:warning:no-previous-prototype-for-hisi_rde_clear_hw_err_status | |-- drivers-crypto-hisilicon-rde-rde_main.c:warning:no-previous-prototype-for-hisi_rde_get_hw_err_status | `-- drivers-crypto-hisilicon-rde-rde_main.c:warning:no-previous-prototype-for-hisi_rde_hw_error_log |-- x86_64-buildonly-randconfig-005-20240727 | `-- drivers-net-ethernet-hisilicon-hns3-hns3_cae-.tmp_hns3_cae_led.o:warning:objtool:missing-symbol-for-section-.text `-- x86_64-randconfig-003-20240806 `-- multiple-definition-of-debug-arch-x86-entry-entry_64.o:arch-x86-entry-entry_64.S:first-defined-here elapsed time: 726m configs tested: 35 configs skipped: 139 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240806 gcc-14.1.0 arm64 randconfig-002-20240806 gcc-14.1.0 arm64 randconfig-003-20240806 gcc-14.1.0 arm64 randconfig-004-20240806 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240806 clang-18 x86_64 buildonly-randconfig-002-20240806 clang-18 x86_64 buildonly-randconfig-003-20240806 clang-18 x86_64 buildonly-randconfig-004-20240806 clang-18 x86_64 buildonly-randconfig-005-20240806 gcc-12 x86_64 buildonly-randconfig-006-20240806 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240806 gcc-12 x86_64 randconfig-002-20240806 gcc-11 x86_64 randconfig-003-20240806 gcc-12 x86_64 randconfig-004-20240806 clang-18 x86_64 randconfig-005-20240806 clang-18 x86_64 randconfig-006-20240806 clang-18 x86_64 randconfig-011-20240806 gcc-12 x86_64 randconfig-012-20240806 gcc-12 x86_64 randconfig-013-20240806 clang-18 x86_64 randconfig-014-20240806 gcc-12 x86_64 randconfig-015-20240806 gcc-12 x86_64 randconfig-016-20240806 gcc-12 x86_64 randconfig-071-20240806 gcc-12 x86_64 randconfig-072-20240806 clang-18 x86_64 randconfig-073-20240806 gcc-11 x86_64 randconfig-074-20240806 gcc-12 x86_64 randconfig-075-20240806 gcc-12 x86_64 randconfig-076-20240806 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15490/23451] ld: drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.o:drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c:50: multiple definition of `debug'; arch/x86/entry/entry_64.o:arch/x86/entry/entry_64.S:1094: first defined here
by kernel test robot 06 Aug '24

06 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b99509998bfe488900920c783664b4b4a70795da commit: ea190d90c609e9909f37afa0d1a19f938ffb95d3 [15490/23451] Huawei BMA: Adding Huawei BMA driver: host_edma_drv config: x86_64-randconfig-003-20240806 (https://download.01.org/0day-ci/archive/20240806/202408062343.e6vm5gKl-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240806/202408062343.e6vm5gKl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408062343.e6vm5gKl-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld: drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.o:drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c:50: multiple definition of `debug'; arch/x86/entry/entry_64.o:arch/x86/entry/entry_64.S:1094: first defined here ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 11568/23451] drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_led.o: warning: objtool: missing symbol for section .text
by kernel test robot 06 Aug '24

06 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b99509998bfe488900920c783664b4b4a70795da commit: eb3a8c90a2b27a2f2dbe26e8a2e7edff6b61417c [11568/23451] net: HNS3: Increase the dft for the command of led config: x86_64-buildonly-randconfig-005-20240727 (https://download.01.org/0day-ci/archive/20240806/202408062209.71Gj0prX-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240806/202408062209.71Gj0prX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408062209.71Gj0prX-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/.tmp_hns3_cae_led.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/3] CVE-2024-41034
by Zhihao Cheng 06 Aug '24

06 Aug '24

Matthew Wilcox (Oracle) (2): nilfs2: Remove check for PageError nilfs2: return the mapped address from nilfs_get_page() Ryusuke Konishi (1): nilfs2: fix kernel bug on rename operation of broken directory fs/nilfs2/dir.c | 83 ++++++++++++++++++++++++++++++++----------------- 1 file changed, 54 insertions(+), 29 deletions(-) -- 2.31.1

2 4

[PATCH OLK-5.10 0/2] fix CVE-2024-42155
by Hongbo Li 06 Aug '24

06 Aug '24

Fix CVE-2024-42155. Holger Dengler (1): s390/pkey: Wipe copies of protected- and secure-keys Hongbo Li (1): Revert "s390/pkey: Wipe copies of protected- and secure-keys" drivers/s390/crypto/pkey_api.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] s390/pkey: Wipe sensitive data on failure
by Peng Zhang 06 Aug '24

06 Aug '24

From: Holger Dengler <dengler(a)linux.ibm.com> mainline inclusion from mainline-v6.10-rc1 commit 1d8c270de5eb74245d72325d285894a577a945d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSLY CVE: CVE-2024-42157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------------------------------------- Wipe sensitive data from stack also if the copy_to_user() fails. Suggested-by: Heiko Carstens <hca(a)linux.ibm.com> Reviewed-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Ingo Franzki <ifranzki(a)linux.ibm.com> Acked-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Holger Dengler <dengler(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/s390/crypto/pkey_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c index fddcc3d3ba81..271ef4b4cddf 100644 --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1154,7 +1154,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (rc) break; if (copy_to_user(ucs, &kcs, sizeof(kcs))) - return -EFAULT; + rc = -EFAULT; memzero_explicit(&kcs, sizeof(kcs)); break; } @@ -1185,7 +1185,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (rc) break; if (copy_to_user(ucp, &kcp, sizeof(kcp))) - return -EFAULT; + rc = -EFAULT; memzero_explicit(&kcp, sizeof(kcp)); break; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] s390/pkey: Wipe sensitive data on failure
by Peng Zhang 06 Aug '24

06 Aug '24

From: Holger Dengler <dengler(a)linux.ibm.com> mainline inclusion from mainline-v6.10-rc1 commit 1d8c270de5eb74245d72325d285894a577a945d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSLY CVE: CVE-2024-42157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------------------------------------- Wipe sensitive data from stack also if the copy_to_user() fails. Suggested-by: Heiko Carstens <hca(a)linux.ibm.com> Reviewed-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Ingo Franzki <ifranzki(a)linux.ibm.com> Acked-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Holger Dengler <dengler(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/s390/crypto/pkey_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c index 6e07a02f4363..eccee7cabf18 100644 --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1154,7 +1154,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (rc) break; if (copy_to_user(ucs, &kcs, sizeof(kcs))) - return -EFAULT; + rc = -EFAULT; memzero_explicit(&kcs, sizeof(kcs)); break; } @@ -1185,7 +1185,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (rc) break; if (copy_to_user(ucp, &kcp, sizeof(kcp))) - return -EFAULT; + rc = -EFAULT; memzero_explicit(&kcp, sizeof(kcp)); break; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix kernel bug on rename operation of broken directory
by Zhihao Cheng 06 Aug '24

06 Aug '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.222 commit a9a466a69b85059b341239766a10efdd3ee68a4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEKP CVE: CVE-2024-41034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a9e1ddc09ca55746079cc479aa3eb6411f0d99d4 ] Syzbot reported that in rename directory operation on broken directory on nilfs2, __block_write_begin_int() called to prepare block write may fail BUG_ON check for access exceeding the folio/page size. This is because nilfs_dotdot(), which gets parent directory reference entry ("..") of the directory to be moved or renamed, does not check consistency enough, and may return location exceeding folio/page size for broken directories. Fix this issue by checking required directory entries ("." and "..") in the first chunk of the directory in nilfs_dotdot(). Link: https://lkml.kernel.org/r/20240628165107.9006-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d3abed1ad3d367fa2627(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d3abed1ad3d367fa2627 Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/nilfs2/dir.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 1de96b40e404..c30278761fa4 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -390,11 +390,39 @@ nilfs_find_entry(struct inode *dir, const struct qstr *qstr, struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct page **p) { - struct nilfs_dir_entry *de = nilfs_get_page(dir, 0, p); + struct page *page; + struct nilfs_dir_entry *de, *next_de; + size_t limit; + char *msg; + de = nilfs_get_page(dir, 0, &page); if (IS_ERR(de)) return NULL; - return nilfs_next_entry(de); + + limit = nilfs_last_byte(dir, 0); /* is a multiple of chunk size */ + if (unlikely(!limit || le64_to_cpu(de->inode) != dir->i_ino || + !nilfs_match(1, ".", de))) { + msg = "missing '.'"; + goto fail; + } + + next_de = nilfs_next_entry(de); + /* + * If "next_de" has not reached the end of the chunk, there is + * at least one more record. Check whether it matches "..". + */ + if (unlikely((char *)next_de == (char *)de + nilfs_chunk_size(dir) || + !nilfs_match(2, "..", next_de))) { + msg = "missing '..'"; + goto fail; + } + *p = page; + return next_de; + +fail: + nilfs_error(dir->i_sb, "directory #%lu %s", dir->i_ino, msg); + nilfs_put_page(page); + return NULL; } ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr) -- 2.31.1

2 1

[PATCH OLK-5.10] nilfs2: fix kernel bug on rename operation of broken directory
by Zhihao Cheng 06 Aug '24

06 Aug '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.222 commit a9a466a69b85059b341239766a10efdd3ee68a4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEKP CVE: CVE-2024-41034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a9e1ddc09ca55746079cc479aa3eb6411f0d99d4 ] Syzbot reported that in rename directory operation on broken directory on nilfs2, __block_write_begin_int() called to prepare block write may fail BUG_ON check for access exceeding the folio/page size. This is because nilfs_dotdot(), which gets parent directory reference entry ("..") of the directory to be moved or renamed, does not check consistency enough, and may return location exceeding folio/page size for broken directories. Fix this issue by checking required directory entries ("." and "..") in the first chunk of the directory in nilfs_dotdot(). Link: https://lkml.kernel.org/r/20240628165107.9006-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d3abed1ad3d367fa2627(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d3abed1ad3d367fa2627 Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/nilfs2/dir.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 1de96b40e404..c30278761fa4 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -390,11 +390,39 @@ nilfs_find_entry(struct inode *dir, const struct qstr *qstr, struct nilfs_dir_entry *nilfs_dotdot(struct inode *dir, struct page **p) { - struct nilfs_dir_entry *de = nilfs_get_page(dir, 0, p); + struct page *page; + struct nilfs_dir_entry *de, *next_de; + size_t limit; + char *msg; + de = nilfs_get_page(dir, 0, &page); if (IS_ERR(de)) return NULL; - return nilfs_next_entry(de); + + limit = nilfs_last_byte(dir, 0); /* is a multiple of chunk size */ + if (unlikely(!limit || le64_to_cpu(de->inode) != dir->i_ino || + !nilfs_match(1, ".", de))) { + msg = "missing '.'"; + goto fail; + } + + next_de = nilfs_next_entry(de); + /* + * If "next_de" has not reached the end of the chunk, there is + * at least one more record. Check whether it matches "..". + */ + if (unlikely((char *)next_de == (char *)de + nilfs_chunk_size(dir) || + !nilfs_match(2, "..", next_de))) { + msg = "missing '..'"; + goto fail; + } + *p = page; + return next_de; + +fail: + nilfs_error(dir->i_sb, "directory #%lu %s", dir->i_ino, msg); + nilfs_put_page(page); + return NULL; } ino_t nilfs_inode_by_name(struct inode *dir, const struct qstr *qstr) -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] crypto: hisilicon/sec - Fix memory leak for sec resource release
by Peng Zhang 06 Aug '24

06 Aug '24

From: Chenghai Huang <huangchenghai2(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit bba4250757b4ae1680fea435a358d8093f254094 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD2XU CVE: CVE-2024-41002 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- The AIV is one of the SEC resources. When releasing resources, it need to release the AIV resources at the same time. Otherwise, memory leakage occurs. The aiv resource release is added to the sec resource release function. Signed-off-by: Chenghai Huang <huangchenghai2(a)huawei.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/crypto/hisilicon/sec2/sec_crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c index 84ae8ddd1a13..6d3ab6c909cf 100644 --- a/drivers/crypto/hisilicon/sec2/sec_crypto.c +++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c @@ -479,8 +479,10 @@ static void sec_alg_resource_free(struct sec_ctx *ctx, if (ctx->pbuf_supported) sec_free_pbuf_resource(dev, qp_ctx->res); - if (ctx->alg_type == SEC_AEAD) + if (ctx->alg_type == SEC_AEAD) { sec_free_mac_resource(dev, qp_ctx->res); + sec_free_aiv_resource(dev, qp_ctx->res); + } } static int sec_alloc_qp_ctx_resource(struct hisi_qm *qm, struct sec_ctx *ctx, -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2021-47582
by Peng Zhang 06 Aug '24

06 Aug '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport 2 bugfixes to fix CVE-2021-47582. Alan Stern (1): USB: core: Make do_proc_control() and do_proc_bulk() killable Tasos Sahanidis (1): usb: core: Don't hold the device lock while sleeping in do_proc_control() drivers/usb/core/devio.c | 146 ++++++++++++++++++++++++++++++--------- 1 file changed, 114 insertions(+), 32 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2021-47582
by Peng Zhang 06 Aug '24

06 Aug '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport 2 patches to fix CVE-2021-47582. Alan Stern (1): USB: core: Make do_proc_control() and do_proc_bulk() killable Tasos Sahanidis (1): usb: core: Don't hold the device lock while sleeping in do_proc_control() drivers/usb/core/devio.c | 146 ++++++++++++++++++++++++++++++--------- 1 file changed, 114 insertions(+), 32 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2024-42160
by Zheng Zucheng 06 Aug '24

06 Aug '24

Fix CVE-2024-42160 Chao Yu (1): f2fs: check validation of fault attrs in f2fs_build_fault_attr() Nathan Chancellor (1): f2fs: Add inline to f2fs_build_fault_attr() stub fs/f2fs/f2fs.h | 12 ++++++++---- fs/f2fs/super.c | 27 ++++++++++++++++++++------- fs/f2fs/sysfs.c | 12 ++++++++++-- 3 files changed, 38 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/1] secure smmu init
by Xiangkai Yang 06 Aug '24

06 Aug '24

virtCCA feature ikarosYuuki (1): secure smmu init arch/arm64/include/asm/kvm_tmi.h | 244 +++-- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 128 ++- arch/arm64/kvm/virtcca_cvm.c | 10 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 841 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 198 +++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 168 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + 10 files changed, 1548 insertions(+), 84 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.27.0

2 2

[PATCH OLK-6.6 0/1] secure smmu init
by y00878127 06 Aug '24

06 Aug '24

From: Xiangkai Yang <yangxiangkai(a)huawei.com> virtCCA feature ikarosYuuki (1): secure smmu init arch/arm64/include/asm/kvm_tmi.h | 244 +++-- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 128 ++- arch/arm64/kvm/virtcca_cvm.c | 10 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 841 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 198 +++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 168 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + 10 files changed, 1548 insertions(+), 84 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.27.0

2 1

[PATCH OLK-6.6 0/1] secure smmu init
by Xiangkai Yang 06 Aug '24

06 Aug '24

virtCCA feature ikarosYuuki (1): secure smmu init arch/arm64/include/asm/kvm_tmi.h | 244 +++-- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 128 ++- arch/arm64/kvm/virtcca_cvm.c | 10 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 841 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 198 +++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 168 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + 10 files changed, 1548 insertions(+), 84 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.27.0

2 2

[PATCH OLK-6.6 0/1] secure smmu init
by y00878127 06 Aug '24

06 Aug '24

From: Xiangkai Yang <yangxiangkai(a)huawei.com> virtCCA feature ikarosYuuki (1): secure smmu init arch/arm64/include/asm/kvm_tmi.h | 244 +++-- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 128 ++- arch/arm64/kvm/virtcca_cvm.c | 10 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 841 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 198 +++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 168 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + 10 files changed, 1548 insertions(+), 84 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.27.0

2 2

[PATCH OLK-6.6 0/1] secure smmu init
by y00878127 06 Aug '24

06 Aug '24

From: Xiangkai Yang <yangxiangkai(a)huawei.com> virtCCA feature ikarosYuuki (1): secure smmu init arch/arm64/include/asm/kvm_tmi.h | 244 +++-- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 128 ++- arch/arm64/kvm/virtcca_cvm.c | 10 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 841 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 198 +++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 168 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + 10 files changed, 1548 insertions(+), 84 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.27.0

2 2

[PATCH OLK-6.6] s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
by Zhang Changzhong 06 Aug '24

06 Aug '24

From: Jules Irenge <jbi.octave(a)gmail.com> mainline inclusion from mainline-v6.10-rc1 commit 22e6824622e8a8889df0f8fc4ed5aea0e702a694 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSJP CVE: CVE-2024-42158 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Replace memzero_explicit() and kfree() with kfree_sensitive() to fix warnings reported by Coccinelle: WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1506) WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1643) WARNING opportunity for kfree_sensitive/kvfree_sensitive (line 1770) Signed-off-by: Jules Irenge <jbi.octave(a)gmail.com> Reviewed-by: Holger Dengler <dengler(a)linux.ibm.com> Link: https://lore.kernel.org/r/ZjqZkNi_JUJu73Rg@octinomon.home Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Conflicts: drivers/s390/crypto/pkey_api.c [commit 6d749b4e0208 ("s390/pkey: introduce dynamic debugging for pkey") is not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/s390/crypto/pkey_api.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c index 436de13..cfbed3a 100644 --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1491,8 +1491,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc = pkey_keyblob2pkey(kkey, ktp.keylen, ktp.protkey.protkey, &ktp.protkey.len, &ktp.protkey.type); DEBUG_DBG("%s pkey_keyblob2pkey()=%d\n", __func__, rc); - memzero_explicit(kkey, ktp.keylen); - kfree(kkey); + kfree_sensitive(kkey); if (!rc && copy_to_user(utp, &ktp, sizeof(ktp))) rc = -EFAULT; memzero_explicit(&ktp, sizeof(ktp)); @@ -1627,8 +1626,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, &ktp.protkey.type); DEBUG_DBG("%s pkey_keyblob2pkey2()=%d\n", __func__, rc); kfree(apqns); - memzero_explicit(kkey, ktp.keylen); - kfree(kkey); + kfree_sensitive(kkey); if (!rc && copy_to_user(utp, &ktp, sizeof(ktp))) rc = -EFAULT; memzero_explicit(&ktp, sizeof(ktp)); @@ -1753,8 +1751,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, protkey, &protkeylen, &ktp.pkeytype); DEBUG_DBG("%s pkey_keyblob2pkey3()=%d\n", __func__, rc); kfree(apqns); - memzero_explicit(kkey, ktp.keylen); - kfree(kkey); + kfree_sensitive(kkey); if (rc) { kfree_sensitive(protkey); break; -- 2.9.5

2 1

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 06 Aug '24

06 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): secure smmu init Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> arch/arm64/include/asm/kvm_tmi.h | 242 +++-- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 128 ++- arch/arm64/kvm/virtcca_cvm.c | 10 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 841 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 198 +++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 168 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + drivers/pci/access.c | 33 + include/linux/iommu.h | 4 + 11 files changed, 1580 insertions(+), 83 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] secure smmu init
by y00878127 06 Aug '24

06 Aug '24

From: Xiangkai Yang <yangxiangkai(a)huawei.com> virtCCA feature ikarosYuuki (1): secure smmu init arch/arm64/include/asm/kvm_tmi.h | 244 +++-- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 128 ++- arch/arm64/kvm/virtcca_cvm.c | 10 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 841 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 198 +++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 168 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + 10 files changed, 1548 insertions(+), 84 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.27.0

2 2

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-41027
by Yongqiang Liu 06 Aug '24

06 Aug '24

Audra Mitchell (1): Fix userfaultfd_api to return EINVAL as expected Peter Xu (1): mm/userfaultfd: fail uffd-wp registration if not supported fs/userfaultfd.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-42155
by Hongbo Li 06 Aug '24

06 Aug '24

Fix CVE-2024-42155. Holger Dengler (1): s390/pkey: Wipe copies of protected- and secure-keys Hongbo Li (1): Revert "s390/pkey: Wipe copies of protected- and secure-keys" drivers/s390/crypto/pkey_api.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH] [Backport] cppc_cpufreq: Fix possible null pointer dereference
by Liu Mingrui 06 Aug '24

06 Aug '24

From: Aleksandr Mishin <amishin(a)t-argos.ru> stable inclusion from stable-v6.6.33 commit f84b9b25d045e67a7eee5e73f21278c8ab06713c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA74DQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cf7de25878a1f4508c69dc9f6819c21ba177dbfe ] cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() can be called from different places with various parameters. So cpufreq_cpu_get() can return null as 'policy' in some circumstances. Fix this bug by adding null return check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: a28b2bfc099c ("cppc_cpufreq: replace per-cpu data array with a list") Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru> Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/cpufreq/cppc_cpufreq.c [Context conflict] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/cpufreq/cppc_cpufreq.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c index 321a9dc9484d..0d60699ad63e 100644 --- a/drivers/cpufreq/cppc_cpufreq.c +++ b/drivers/cpufreq/cppc_cpufreq.c @@ -865,10 +865,15 @@ static unsigned int cppc_cpufreq_get_rate(unsigned int cpu) { struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); - struct cppc_cpudata *cpu_data = policy->driver_data; + struct cppc_cpudata *cpu_data; u64 delivered_perf; int ret; + if (!policy) + return -ENODEV; + + cpu_data = policy->driver_data; + cpufreq_cpu_put(policy); if (cpu_has_amu_feat(cpu)) @@ -948,10 +953,15 @@ static struct cpufreq_driver cppc_cpufreq_driver = { static unsigned int hisi_cppc_cpufreq_get_rate(unsigned int cpu) { struct cpufreq_policy *policy = cpufreq_cpu_get(cpu); - struct cppc_cpudata *cpu_data = policy->driver_data; + struct cppc_cpudata *cpu_data; u64 desired_perf; int ret; + if (!policy) + return -ENODEV; + + cpu_data = policy->driver_data; + cpufreq_cpu_put(policy); ret = cppc_get_desired_perf(cpu, &desired_perf); -- 2.25.1

2 2

[PATCH OLK-5.10 0/2] CVE-2024-41027
by Yongqiang Liu 06 Aug '24

06 Aug '24

Audra Mitchell (1): Fix userfaultfd_api to return EINVAL as expected Peter Xu (1): mm/userfaultfd: fail uffd-wp registration if not supported fs/userfaultfd.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2024-41027
by Yongqiang Liu 06 Aug '24

06 Aug '24

Audra Mitchell (1): Fix userfaultfd_api to return EINVAL as expected Peter Xu (1): mm/userfaultfd: fail uffd-wp registration if not supported fs/userfaultfd.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-41016
by Yu Liao 06 Aug '24

06 Aug '24

Ferry Meng (2): ocfs2: add bounds checking to ocfs2_xattr_find_entry() ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() fs/ocfs2/xattr.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] leds: an30259a: Use devm_mutex_init() for mutex initialization
by GONG, Ruiqi 06 Aug '24

06 Aug '24

From: George Stark <gnstark(a)salutedevices.com> mainline inclusion from mainline-v6.10-rc1 commit c382e2e3eccb6b7ca8c7aff5092c1668428e7de6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGRQX CVE: CVE-2024-42128 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In this driver LEDs are registered using devm_led_classdev_register() so they are automatically unregistered after module's remove() is done. led_classdev_unregister() calls module's led_set_brightness() to turn off the LEDs and that callback uses mutex which was destroyed already in module's remove() so use devm API instead. Signed-off-by: George Stark <gnstark(a)salutedevices.com> Reviewed-by: Andy Shevchenko <andy.shevchenko(a)gmail.com> Link: https://lore.kernel.org/r/20240411161032.609544-9-gnstark@salutedevices.com Signed-off-by: Lee Jones <lee(a)kernel.org> Conflicts: drivers/leds/leds-an30259a.c [Context conflicts.] Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- drivers/leds/leds-an30259a.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/drivers/leds/leds-an30259a.c b/drivers/leds/leds-an30259a.c index a0df1fb28774..374011e3121e 100644 --- a/drivers/leds/leds-an30259a.c +++ b/drivers/leds/leds-an30259a.c @@ -296,7 +296,10 @@ static int an30259a_probe(struct i2c_client *client) if (err < 0) return err; - mutex_init(&chip->mutex); + err = devm_mutex_init(&client->dev, &chip->mutex); + if (err) + return err; + chip->client = client; i2c_set_clientdata(client, chip); @@ -330,19 +333,9 @@ static int an30259a_probe(struct i2c_client *client) return 0; exit: - mutex_destroy(&chip->mutex); return err; } -static int an30259a_remove(struct i2c_client *client) -{ - struct an30259a *chip = i2c_get_clientdata(client); - - mutex_destroy(&chip->mutex); - - return 0; -} - static const struct of_device_id an30259a_match_table[] = { { .compatible = "panasonic,an30259a", }, { /* sentinel */ }, @@ -362,7 +355,6 @@ static struct i2c_driver an30259a_driver = { .of_match_table = of_match_ptr(an30259a_match_table), }, .probe_new = an30259a_probe, - .remove = an30259a_remove, .id_table = an30259a_id, }; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2024-42160
by Zheng Zucheng 06 Aug '24

06 Aug '24

Fix CVE-2024-42160 Chao Yu (1): f2fs: check validation of fault attrs in f2fs_build_fault_attr() Nathan Chancellor (1): f2fs: Add inline to f2fs_build_fault_attr() stub fs/f2fs/f2fs.h | 12 ++++++++---- fs/f2fs/super.c | 27 ++++++++++++++++++++------- fs/f2fs/sysfs.c | 12 ++++++++++-- 3 files changed, 38 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2024-42160
by Zheng Zucheng 06 Aug '24

06 Aug '24

Fix CVE-2024-42160 Chao Yu (1): f2fs: check validation of fault attrs in f2fs_build_fault_attr() Nathan Chancellor (1): f2fs: Add inline to f2fs_build_fault_attr() stub fs/f2fs/f2fs.h | 12 ++++++++---- fs/f2fs/super.c | 27 ++++++++++++++++++++------- fs/f2fs/sysfs.c | 14 ++++++++++---- 3 files changed, 38 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-42160
by Zheng Zucheng 06 Aug '24

06 Aug '24

Fix CVE-2024-42160 Chao Yu (1): f2fs: check validation of fault attrs in f2fs_build_fault_attr() Nathan Chancellor (1): f2fs: Add inline to f2fs_build_fault_attr() stub fs/f2fs/f2fs.h | 12 ++++++++---- fs/f2fs/super.c | 27 ++++++++++++++++++++------- fs/f2fs/sysfs.c | 14 ++++++++++---- 3 files changed, 38 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/3] CVE-2024-41045
by Pu Lehui 06 Aug '24

06 Aug '24

Benjamin Tissoires (2): bpf: replace bpf_timer_set_callback with a generic helper bpf: replace bpf_timer_cancel_and_free with a generic helper Kumar Kartikeya Dwivedi (1): bpf: Defer work in bpf_timer_cancel_and_free kernel/bpf/helpers.c | 130 +++++++++++++++++++++++++++++-------------- 1 file changed, 89 insertions(+), 41 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 06 Aug '24

06 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): part1 arch/arm64/include/asm/kvm_tmi.h | 93 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 150 +++- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 811 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 175 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + drivers/pci/access.c | 33 + drivers/pci/msi/msi.c | 90 +- drivers/vfio/pci/vfio_pci_core.c | 5 + drivers/vfio/pci/vfio_pci_rdwr.c | 61 ++ drivers/vfio/vfio_iommu_type1.c | 17 + drivers/vfio/vfio_main.c | 18 + include/linux/iommu.h | 9 + include/linux/iopoll.h | 38 + include/linux/pci.h | 4 + include/linux/vfio.h | 5 + include/uapi/linux/vfio.h | 3 + virt/kvm/vfio.c | 121 ++- virt/kvm/vfio.h | 10 + 22 files changed, 1828 insertions(+), 16 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 06 Aug '24

06 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): part1 arch/arm64/include/asm/kvm_tmi.h | 93 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 150 +++- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 811 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 175 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + drivers/pci/access.c | 33 + drivers/pci/msi/msi.c | 90 +- drivers/vfio/pci/vfio_pci_core.c | 5 + drivers/vfio/pci/vfio_pci_rdwr.c | 61 ++ drivers/vfio/vfio_iommu_type1.c | 17 + drivers/vfio/vfio_main.c | 18 + include/linux/iommu.h | 9 + include/linux/iopoll.h | 38 + include/linux/pci.h | 4 + include/linux/vfio.h | 5 + include/uapi/linux/vfio.h | 3 + virt/kvm/vfio.c | 121 ++- virt/kvm/vfio.h | 10 + 22 files changed, 1828 insertions(+), 16 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] coda part 1
by y00878127 06 Aug '24

06 Aug '24

From: Xiangkai Yang <yangxiangkai(a)huawei.com> virtCCA feature Xiangkai Yang (1): coda part1 arch/arm64/include/asm/kvm_tmi.h | 88 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 152 +++- arch/arm64/kvm/virtcca_cvm.c | 10 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 811 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 175 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + include/linux/iopoll.h | 38 + 11 files changed, 1471 insertions(+), 6 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.25.1

2 2

[openeuler:OLK-6.6 12699/13217] arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23000000: Unevaluated properties are not allowed ('dma-coherent', 'phy-handle', 'phy-mode', 'power-domains', 'rx-fifo-depth', 'rx-queues-config', 'snps,mtl-rx-config', 'snps,mtl-tx-config', 'snps,pbl', '...
by kernel test robot 06 Aug '24

06 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d59a335bf0dd2aac9debe211a0a07fbeaf605fed commit: 79effa9d33aed236955bd5d6ea9588b16958803b [12699/13217] arm64: dts: qcom: sa8775p: mark ethernet devices as DMA-coherent :::::: branch date: 5 hours ago :::::: commit date: 2 days ago config: arm64-randconfig-051-20240805 (https://download.01.org/0day-ci/archive/20240806/202408060203.7OzdIHxS-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 423aec6573df4424f90555468128e17073ddc69e) dtschema version: 2024.6.dev8+gf13c181 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240806/202408060203.7OzdIHxS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/r/202408060203.7OzdIHxS-lkp@intel.com/ dtcheck warnings: (new ones prefixed by >>) arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: rsc@18200000: 'power-domains' is a required property from schema $id: http://devicetree.org/schemas/soc/qcom/qcom,rpmh-rsc.yaml# arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23000000: rx-queues-config:queue0:snps,priority: [1] is not of type 'integer' from schema $id: http://devicetree.org/schemas/net/qcom,ethqos.yaml# arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23000000: rx-queues-config:queue3:snps,priority: [12] is not of type 'integer' from schema $id: http://devicetree.org/schemas/net/qcom,ethqos.yaml# arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23000000: snps,pbl: [32] is not of type 'integer' from schema $id: http://devicetree.org/schemas/net/qcom,ethqos.yaml# arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23000000: snps,pbl: [32] is not one of [1, 2, 4, 8, 16, 32] from schema $id: http://devicetree.org/schemas/net/qcom,ethqos.yaml# >> arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23000000: Unevaluated properties are not allowed ('dma-coherent', 'phy-handle', 'phy-mode', 'power-domains', 'rx-fifo-depth', 'rx-queues-config', 'snps,mtl-rx-config', 'snps,mtl-tx-config', 'snps,pbl', 'snps,ps-speed', 'snps,tso', 'tx-fifo-depth', 'tx-queues-config' were unexpected) from schema $id: http://devicetree.org/schemas/net/qcom,ethqos.yaml# arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23040000: rx-queues-config:queue0:snps,priority: [1] is not of type 'integer' from schema $id: http://devicetree.org/schemas/net/qcom,ethqos.yaml# arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23040000: rx-queues-config:queue3:snps,priority: [12] is not of type 'integer' from schema $id: http://devicetree.org/schemas/net/qcom,ethqos.yaml# arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23040000: snps,pbl: [32] is not of type 'integer' from schema $id: http://devicetree.org/schemas/net/qcom,ethqos.yaml# arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23040000: snps,pbl: [32] is not one of [1, 2, 4, 8, 16, 32] from schema $id: http://devicetree.org/schemas/net/qcom,ethqos.yaml# >> arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23040000: Unevaluated properties are not allowed ('dma-coherent', 'mdio', 'phy-handle', 'phy-mode', 'power-domains', 'rx-fifo-depth', 'rx-queues-config', 'snps,mtl-rx-config', 'snps,mtl-tx-config', 'snps,pbl', 'snps,ps-speed', 'snps,tso', 'tx-fifo-depth', 'tx-queues-config' were unexpected) from schema $id: http://devicetree.org/schemas/net/qcom,ethqos.yaml# -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] coda part 1
by y00878127 06 Aug '24

06 Aug '24

From: Xiangkai Yang <yangxiangkai(a)huawei.com> virtCCA feature Xiangkai Yang (1): part1 arch/arm64/include/asm/kvm_tmi.h | 88 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 152 +++- arch/arm64/kvm/virtcca_cvm.c | 10 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 811 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 175 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + include/linux/iopoll.h | 38 + 11 files changed, 1471 insertions(+), 6 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.25.1

2 2

[PATCH OLK-6.6] btrfs: qgroup: fix quota root leak after quota disable failure
by Wang Zhaolong 06 Aug '24

06 Aug '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.10-rc6 commit a7e4c6a3031c74078dba7fa36239d0f4fe476c53 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEN9 CVE: CVE-2024-41078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the reference on the quota root, resulting in a leak of the root since fs_info->quota_root is no longer pointing to the root (we have set it to NULL just before those steps). Fix this by always doing a btrfs_put_root() call under the 'out' label. This is a problem that exists since qgroups were first added in 2012 by commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but back then we missed a kfree on the quota root and free_extent_buffer() calls on its root and commit root nodes, since back then roots were not yet reference counted. Reviewed-by: Boris Burkov <boris(a)bur.io> Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/btrfs/qgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c index 99ea2c6d3194..223dfbf00993 100644 --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -1228,7 +1228,7 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) int btrfs_quota_disable(struct btrfs_fs_info *fs_info) { - struct btrfs_root *quota_root; + struct btrfs_root *quota_root = NULL; struct btrfs_trans_handle *trans = NULL; int ret = 0; @@ -1323,9 +1323,9 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) btrfs_free_tree_block(trans, btrfs_root_id(quota_root), quota_root->node, 0, 1); - btrfs_put_root(quota_root); out: + btrfs_put_root(quota_root); mutex_unlock(&fs_info->qgroup_ioctl_lock); if (ret && trans) btrfs_end_transaction(trans); -- 2.34.3

2 1

[PATCH OLK-5.10] btrfs: qgroup: fix quota root leak after quota disable failure
by Wang Zhaolong 06 Aug '24

06 Aug '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v5.10.223 commit 94818bdb00ef34a996a06aa63d11f591074cb757 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEN9 CVE: CVE-2024-41078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a7e4c6a3031c74078dba7fa36239d0f4fe476c53 ] If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the reference on the quota root, resulting in a leak of the root since fs_info->quota_root is no longer pointing to the root (we have set it to NULL just before those steps). Fix this by always doing a btrfs_put_root() call under the 'out' label. This is a problem that exists since qgroups were first added in 2012 by commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but back then we missed a kfree on the quota root and free_extent_buffer() calls on its root and commit root nodes, since back then roots were not yet reference counted. Reviewed-by: Boris Burkov <boris(a)bur.io> Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/btrfs/qgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c index 7aae7a57f2b2..d59fab19659f 100644 --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -1197,7 +1197,7 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) int btrfs_quota_disable(struct btrfs_fs_info *fs_info) { - struct btrfs_root *quota_root; + struct btrfs_root *quota_root = NULL; struct btrfs_trans_handle *trans = NULL; int ret = 0; @@ -1277,9 +1277,9 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) btrfs_tree_unlock(quota_root->node); btrfs_free_tree_block(trans, quota_root, quota_root->node, 0, 1); - btrfs_put_root(quota_root); out: + btrfs_put_root(quota_root); mutex_unlock(&fs_info->qgroup_ioctl_lock); if (ret && trans) btrfs_end_transaction(trans); -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: qgroup: fix quota root leak after quota disable failure
by Wang Zhaolong 06 Aug '24

06 Aug '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v5.10.223 commit 94818bdb00ef34a996a06aa63d11f591074cb757 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEN9 CVE: CVE-2024-41078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a7e4c6a3031c74078dba7fa36239d0f4fe476c53 ] If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the reference on the quota root, resulting in a leak of the root since fs_info->quota_root is no longer pointing to the root (we have set it to NULL just before those steps). Fix this by always doing a btrfs_put_root() call under the 'out' label. This is a problem that exists since qgroups were first added in 2012 by commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but back then we missed a kfree on the quota root and free_extent_buffer() calls on its root and commit root nodes, since back then roots were not yet reference counted. Reviewed-by: Boris Burkov <boris(a)bur.io> Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/btrfs/qgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c index 7aae7a57f2b2..d59fab19659f 100644 --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -1197,7 +1197,7 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) int btrfs_quota_disable(struct btrfs_fs_info *fs_info) { - struct btrfs_root *quota_root; + struct btrfs_root *quota_root = NULL; struct btrfs_trans_handle *trans = NULL; int ret = 0; @@ -1277,9 +1277,9 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) btrfs_tree_unlock(quota_root->node); btrfs_free_tree_block(trans, quota_root, quota_root->node, 0, 1); - btrfs_put_root(quota_root); out: + btrfs_put_root(quota_root); mutex_unlock(&fs_info->qgroup_ioctl_lock); if (ret && trans) btrfs_end_transaction(trans); -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1 v2 0/2] CVE-2024-41016
by Yu Liao 06 Aug '24

06 Aug '24

Ferry Meng (2): ocfs2: add bounds checking to ocfs2_xattr_find_entry() ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() fs/ocfs2/xattr.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/1] coda part 1
by y00878127 06 Aug '24

06 Aug '24

From: Xiangkai Yang <yangxiangkai(a)huawei.com> virtCCA feature Xiangkai Yang (1): part1 arch/arm64/include/asm/kvm_tmi.h | 88 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 152 +++- arch/arm64/kvm/virtcca_cvm.c | 11 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 811 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 175 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + include/linux/iopoll.h | 38 + 11 files changed, 1472 insertions(+), 6 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.27.0

2 2

[PATCH OLK-5.10 v2 0/2] CVE-2024-41016
by Yu Liao 06 Aug '24

06 Aug '24

Ferry Meng (2): ocfs2: add bounds checking to ocfs2_xattr_find_entry() ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() fs/ocfs2/xattr.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] jfs: xattr: fix buffer overflow for invalid xattr
by Xia Fukun 06 Aug '24

06 Aug '24

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v6.10-rc1 commit 7c55b78818cfb732680c4a72ab270cc2d2ee3d0f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0FK CVE: CVE-2024-40902 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than the expected size, printing it out can cause an access off the end of the buffer. Fix this all up by properly restricting the size of the debug hex dump in the kernel log. Reported-by: syzbot+9dfe490c8176301c1d06(a)syzkaller.appspotmail.com Cc: Dave Kleikamp <shaggy(a)kernel.org> Link: https://lore.kernel.org/r/2024051433-slider-cloning-98f9@gregkh Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/jfs/xattr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index db41e7803163e..7ae54f78a5b0b 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -557,9 +557,11 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size) size_check: if (EALIST_SIZE(ea_buf->xattr) != ea_size) { + int size = min_t(int, EALIST_SIZE(ea_buf->xattr), ea_size); + printk(KERN_ERR "ea_get: invalid extended attribute\n"); print_hex_dump(KERN_ERR, "", DUMP_PREFIX_ADDRESS, 16, 1, - ea_buf->xattr, ea_size, 1); + ea_buf->xattr, size, 1); ea_release(inode, ea_buf); rc = -EIO; goto clean_up; -- 2.34.1

2 1

[PATCH OLK-6.6] irqchip/mbigen: Fix mbigen node address layout
by Yipeng Zou 06 Aug '24

06 Aug '24

linux-next inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAI2U3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/… -------------------------------- The mbigen interrupt chip has its per node registers located in a contiguous region of page sized chunks. The code maps them into virtual address space as a contiguous region and determines the address of a node by using the node ID as index. mbigen chip |-----------------|------------|--------------| mgn_node_0 mgn_node_1 ... mgn_node_i |--------------| |--------------| |----------------------| [0x0000, 0x0x0FFF] [0x1000, 0x1FFF] [i*0x1000, (i+1)*0x1000 - 1] This works correctly up to 10 nodes, but then fails because the 11th's array slot is used for the MGN_CLEAR registers. mbigen chip |-----------|--------|--------|---------------|--------| mgn_node_0 mgn_node_1 ... mgn_clear_register ... mgn_node_i |-----------------| [0xA000, 0xAFFF] Skip the MGN_CLEAR register space when calculating the offset for node IDs greater than or equal to ten. Fixes: a6c2f87b8820 ("irqchip/mbigen: Implement the mbigen irq chip operation functions") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/all/20240730014400.1751530-1-zouyipeng@huawei.com Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index c75cd0fa213b..4e603fa73c33 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -300,6 +300,20 @@ static int vtimer_mbigen_set_type(unsigned int cpu_id) } #endif +static inline unsigned int get_mbigen_node_offset(unsigned int nid) +{ + unsigned int offset = nid * MBIGEN_NODE_OFFSET; + + /* + * To avoid touched clear register in unexpected way, we need to directly + * skip clear register when access to more than 10 mbigen nodes. + */ + if (nid >= (REG_MBIGEN_CLEAR_OFFSET / MBIGEN_NODE_OFFSET)) + offset += MBIGEN_NODE_OFFSET; + + return offset; +} + static inline unsigned int get_mbigen_vec_reg(irq_hw_number_t hwirq) { unsigned int nid, pin; @@ -313,8 +327,7 @@ static inline unsigned int get_mbigen_vec_reg(irq_hw_number_t hwirq) nid = hwirq / IRQS_PER_MBIGEN_NODE + 1; pin = hwirq % IRQS_PER_MBIGEN_NODE; - return pin * 4 + nid * MBIGEN_NODE_OFFSET - + REG_MBIGEN_LPI_VEC_OFFSET; + return pin * 4 + get_mbigen_node_offset(nid) + REG_MBIGEN_LPI_VEC_OFFSET; } static inline void get_mbigen_type_reg(irq_hw_number_t hwirq, @@ -338,8 +351,7 @@ static inline void get_mbigen_type_reg(irq_hw_number_t hwirq, *mask = 1 << (irq_ofst % 32); ofst = irq_ofst / 32 * 4; - *addr = ofst + nid * MBIGEN_NODE_OFFSET - + REG_MBIGEN_LPI_TYPE_OFFSET; + *addr = ofst + get_mbigen_node_offset(nid) + REG_MBIGEN_LPI_TYPE_OFFSET; } static inline void get_mbigen_clear_reg(irq_hw_number_t hwirq, -- 2.34.1

2 1

[PATCH OLK-5.10] jfs: xattr: fix buffer overflow for invalid xattr
by Xia Fukun 06 Aug '24

06 Aug '24

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v6.10-rc1 commit 7c55b78818cfb732680c4a72ab270cc2d2ee3d0f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0FK CVE: CVE-2024-40902 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than the expected size, printing it out can cause an access off the end of the buffer. Fix this all up by properly restricting the size of the debug hex dump in the kernel log. Reported-by: syzbot+9dfe490c8176301c1d06(a)syzkaller.appspotmail.com Cc: Dave Kleikamp <shaggy(a)kernel.org> Link: https://lore.kernel.org/r/2024051433-slider-cloning-98f9@gregkh Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/jfs/xattr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index db41e7803163e..7ae54f78a5b0b 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -557,9 +557,11 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size) size_check: if (EALIST_SIZE(ea_buf->xattr) != ea_size) { + int size = min_t(int, EALIST_SIZE(ea_buf->xattr), ea_size); + printk(KERN_ERR "ea_get: invalid extended attribute\n"); print_hex_dump(KERN_ERR, "", DUMP_PREFIX_ADDRESS, 16, 1, - ea_buf->xattr, ea_size, 1); + ea_buf->xattr, size, 1); ea_release(inode, ea_buf); rc = -EIO; goto clean_up; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] media: mediatek: vcodec: Only free buffer VA that is not NULL
by Zheng Yejian 06 Aug '24

06 Aug '24

From: Fei Shao <fshao(a)chromium.org> mainline inclusion from mainline-v6.10-rc1 commit eb005c801ec70ff4307727bd3bd6e8280169ef32 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAH97R CVE: CVE-2023-52888 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- In the MediaTek vcodec driver, while mtk_vcodec_mem_free() is mostly called only when the buffer to free exists, there are some instances that didn't do the check and triggered warnings in practice. We believe those checks were forgotten unintentionally. Add the checks back to fix the warnings. Fixes: 2cc93862d484 ("[media] vcodec: mediatek: Add Mediatek H264 Video Encoder Driver") Conflicts: drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c drivers/media/platform/mediatek/vcodec/encoder/venc/venc_h264_if.c drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c [Resolve conflicts due to lack of several refactor codes] Signed-off-by: Fei Shao <fshao(a)chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Signed-off-by: Andrzej Pietrasiewicz <andrzej.p(a)collabora.com> Signed-off-by: Sebastian Fricke <sebastian.fricke(a)collabora.com> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c b/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c index d0123dfc5f93..aadeac1131b0 100644 --- a/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c +++ b/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c @@ -231,11 +231,12 @@ static void h264_enc_free_work_buf(struct venc_h264_inst *inst) * other buffers need to be freed by AP. */ for (i = 0; i < VENC_H264_VPU_WORK_BUF_MAX; i++) { - if (i != VENC_H264_VPU_WORK_BUF_SKIP_FRAME) + if (i != VENC_H264_VPU_WORK_BUF_SKIP_FRAME && inst->work_bufs[i].va) mtk_vcodec_mem_free(inst->ctx, &inst->work_bufs[i]); } - mtk_vcodec_mem_free(inst->ctx, &inst->pps_buf); + if (inst->pps_buf.va) + mtk_vcodec_mem_free(inst->ctx, &inst->pps_buf); mtk_vcodec_debug_leave(inst); } -- 2.25.1

2 1

[PATCH OLK-5.10] media: mediatek: vcodec: Only free buffer VA that is not NULL
by Zheng Yejian 06 Aug '24

06 Aug '24

From: Fei Shao <fshao(a)chromium.org> mainline inclusion from mainline-v6.10-rc1 commit eb005c801ec70ff4307727bd3bd6e8280169ef32 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAH97R CVE: CVE-2023-52888 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- In the MediaTek vcodec driver, while mtk_vcodec_mem_free() is mostly called only when the buffer to free exists, there are some instances that didn't do the check and triggered warnings in practice. We believe those checks were forgotten unintentionally. Add the checks back to fix the warnings. Fixes: 2cc93862d484 ("[media] vcodec: mediatek: Add Mediatek H264 Video Encoder Driver") Conflicts: drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c drivers/media/platform/mediatek/vcodec/encoder/venc/venc_h264_if.c drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c [Resolve conflicts due to lack of several refactor codes] Signed-off-by: Fei Shao <fshao(a)chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Signed-off-by: Andrzej Pietrasiewicz <andrzej.p(a)collabora.com> Signed-off-by: Sebastian Fricke <sebastian.fricke(a)collabora.com> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c b/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c index d0123dfc5f93..aadeac1131b0 100644 --- a/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c +++ b/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c @@ -231,11 +231,12 @@ static void h264_enc_free_work_buf(struct venc_h264_inst *inst) * other buffers need to be freed by AP. */ for (i = 0; i < VENC_H264_VPU_WORK_BUF_MAX; i++) { - if (i != VENC_H264_VPU_WORK_BUF_SKIP_FRAME) + if (i != VENC_H264_VPU_WORK_BUF_SKIP_FRAME && inst->work_bufs[i].va) mtk_vcodec_mem_free(inst->ctx, &inst->work_bufs[i]); } - mtk_vcodec_mem_free(inst->ctx, &inst->pps_buf); + if (inst->pps_buf.va) + mtk_vcodec_mem_free(inst->ctx, &inst->pps_buf); mtk_vcodec_debug_leave(inst); } -- 2.25.1

2 1

[PATCH OLK-5.10] irqchip/mbigen: Fix mbigen node address layout
by Yipeng Zou 06 Aug '24

06 Aug '24

linux-next inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAI2U3 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/… -------------------------------- The mbigen interrupt chip has its per node registers located in a contiguous region of page sized chunks. The code maps them into virtual address space as a contiguous region and determines the address of a node by using the node ID as index. mbigen chip |-----------------|------------|--------------| mgn_node_0 mgn_node_1 ... mgn_node_i |--------------| |--------------| |----------------------| [0x0000, 0x0x0FFF] [0x1000, 0x1FFF] [i*0x1000, (i+1)*0x1000 - 1] This works correctly up to 10 nodes, but then fails because the 11th's array slot is used for the MGN_CLEAR registers. mbigen chip |-----------|--------|--------|---------------|--------| mgn_node_0 mgn_node_1 ... mgn_clear_register ... mgn_node_i |-----------------| [0xA000, 0xAFFF] Skip the MGN_CLEAR register space when calculating the offset for node IDs greater than or equal to ten. Fixes: a6c2f87b8820 ("irqchip/mbigen: Implement the mbigen irq chip operation functions") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/all/20240730014400.1751530-1-zouyipeng@huawei.com Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/irqchip/irq-mbigen.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c index 16090b620496..8f5cf7bb79a7 100644 --- a/drivers/irqchip/irq-mbigen.c +++ b/drivers/irqchip/irq-mbigen.c @@ -291,6 +291,20 @@ static int vtimer_mbigen_set_type(unsigned int cpu_id) return 0; } +static inline unsigned int get_mbigen_node_offset(unsigned int nid) +{ + unsigned int offset = nid * MBIGEN_NODE_OFFSET; + + /* + * To avoid touched clear register in unexpected way, we need to directly + * skip clear register when access to more than 10 mbigen nodes. + */ + if (nid >= (REG_MBIGEN_CLEAR_OFFSET / MBIGEN_NODE_OFFSET)) + offset += MBIGEN_NODE_OFFSET; + + return offset; +} + static inline unsigned int get_mbigen_vec_reg(irq_hw_number_t hwirq) { unsigned int nid, pin; @@ -302,8 +316,7 @@ static inline unsigned int get_mbigen_vec_reg(irq_hw_number_t hwirq) nid = hwirq / IRQS_PER_MBIGEN_NODE + 1; pin = hwirq % IRQS_PER_MBIGEN_NODE; - return pin * 4 + nid * MBIGEN_NODE_OFFSET - + REG_MBIGEN_LPI_VEC_OFFSET; + return pin * 4 + get_mbigen_node_offset(nid) + REG_MBIGEN_LPI_VEC_OFFSET; } static inline void get_mbigen_type_reg(irq_hw_number_t hwirq, @@ -325,8 +338,7 @@ static inline void get_mbigen_type_reg(irq_hw_number_t hwirq, *mask = 1 << (irq_ofst % 32); ofst = irq_ofst / 32 * 4; - *addr = ofst + nid * MBIGEN_NODE_OFFSET - + REG_MBIGEN_LPI_TYPE_OFFSET; + *addr = ofst + get_mbigen_node_offset(nid) + REG_MBIGEN_LPI_TYPE_OFFSET; } static inline void get_mbigen_clear_reg(irq_hw_number_t hwirq, -- 2.34.1

2 1

[PATCH OLK-6.6] ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
by Yu Liao 06 Aug '24

06 Aug '24

From: Ferry Meng <mengferry(a)linux.alibaba.com> mainline inclusion from mainline-v6.11-rc1 commit af77c4fc1871847b528d58b7fdafb4aa1f6a9262 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAG8SI CVE: CVE-2024-41016 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images. Link: https://lkml.kernel.org/r/20240520024024.1976129-2-joseph.qi@linux.alibaba.… Signed-off-by: Ferry Meng <mengferry(a)linux.alibaba.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: lei lu <llfamsec(a)gmail.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Mark Fasheh <mark(a)fasheh.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- fs/ocfs2/xattr.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index b562cfef888a..b211dc17af3e 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -1068,7 +1068,7 @@ static int ocfs2_xattr_find_entry(int name_index, { struct ocfs2_xattr_entry *entry; size_t name_len; - int i, cmp = 1; + int i, name_offset, cmp = 1; if (name == NULL) return -EINVAL; @@ -1079,10 +1079,15 @@ static int ocfs2_xattr_find_entry(int name_index, cmp = name_index - ocfs2_xattr_get_type(entry); if (!cmp) cmp = name_len - entry->xe_name_len; - if (!cmp) - cmp = memcmp(name, (xs->base + - le16_to_cpu(entry->xe_name_offset)), - name_len); + if (!cmp) { + name_offset = le16_to_cpu(entry->xe_name_offset); + if ((xs->base + name_offset + name_len) > xs->end) { + ocfs2_error(inode->i_sb, + "corrupted xattr entries"); + return -EFSCORRUPTED; + } + cmp = memcmp(name, (xs->base + name_offset), name_len); + } if (cmp == 0) break; entry += 1; -- 2.25.1

2 1

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 06 Aug '24

06 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): part1 arch/arm64/include/asm/kvm_tmi.h | 93 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 150 +++- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 811 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 175 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + drivers/vfio/pci/vfio_pci_core.c | 5 + drivers/vfio/pci/vfio_pci_rdwr.c | 61 ++ drivers/vfio/vfio_iommu_type1.c | 17 + drivers/vfio/vfio_main.c | 18 + include/linux/iommu.h | 9 + include/linux/iopoll.h | 38 + include/linux/pci.h | 4 + include/linux/vfio.h | 5 + include/uapi/linux/vfio.h | 3 + virt/kvm/vfio.c | 121 ++- virt/kvm/vfio.h | 10 + 20 files changed, 1714 insertions(+), 7 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.25.1

2 2

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS WITH WARNING f10f25f5188cddb47d7a8a4ddf63c200b33e5b49
by kernel test robot 06 Aug '24

06 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: f10f25f5188cddb47d7a8a4ddf63c200b33e5b49 !10693 drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes Warning reports: https://lore.kernel.org/oe-kbuild-all/202408060608.ESB5dO3f-lkp@intel.com Warning: (recently discovered and may have been fixed) drivers/crypto/hisilicon/rde/rde_main.c:576:6: warning: no previous prototype for 'hisi_rde_hw_error_log' [-Wmissing-prototypes] drivers/crypto/hisilicon/rde/rde_main.c:607:5: warning: no previous prototype for 'hisi_rde_get_hw_err_status' [-Wmissing-prototypes] drivers/crypto/hisilicon/rde/rde_main.c:612:6: warning: no previous prototype for 'hisi_rde_clear_hw_err_status' [-Wmissing-prototypes] Warning ids grouped by kconfigs: recent_errors `-- arm64-randconfig-002-20240806 |-- drivers-crypto-hisilicon-rde-rde_main.c:warning:no-previous-prototype-for-hisi_rde_clear_hw_err_status |-- drivers-crypto-hisilicon-rde-rde_main.c:warning:no-previous-prototype-for-hisi_rde_get_hw_err_status `-- drivers-crypto-hisilicon-rde-rde_main.c:warning:no-previous-prototype-for-hisi_rde_hw_error_log elapsed time: 738m configs tested: 35 configs skipped: 139 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240806 gcc-14.1.0 arm64 randconfig-002-20240806 gcc-14.1.0 arm64 randconfig-003-20240806 gcc-14.1.0 arm64 randconfig-004-20240806 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240806 clang-18 x86_64 buildonly-randconfig-002-20240806 clang-18 x86_64 buildonly-randconfig-003-20240806 clang-18 x86_64 buildonly-randconfig-004-20240806 clang-18 x86_64 buildonly-randconfig-005-20240806 gcc-12 x86_64 buildonly-randconfig-006-20240806 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240806 gcc-12 x86_64 randconfig-002-20240806 gcc-11 x86_64 randconfig-003-20240806 gcc-12 x86_64 randconfig-004-20240806 clang-18 x86_64 randconfig-005-20240806 clang-18 x86_64 randconfig-006-20240806 clang-18 x86_64 randconfig-011-20240806 gcc-12 x86_64 randconfig-012-20240806 gcc-12 x86_64 randconfig-013-20240806 clang-18 x86_64 randconfig-014-20240806 gcc-12 x86_64 randconfig-015-20240806 gcc-12 x86_64 randconfig-016-20240806 gcc-12 x86_64 randconfig-071-20240806 gcc-12 x86_64 randconfig-072-20240806 clang-18 x86_64 randconfig-073-20240806 gcc-11 x86_64 randconfig-074-20240806 gcc-12 x86_64 randconfig-075-20240806 gcc-12 x86_64 randconfig-076-20240806 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION d59a335bf0dd2aac9debe211a0a07fbeaf605fed
by kernel test robot 06 Aug '24

06 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: d59a335bf0dd2aac9debe211a0a07fbeaf605fed !10639 s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202408060639.d1BhjbnX-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) arch/arm64/kvm/arm.c:138:7: warning: variable 'r' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] arch/arm64/kvm/tmi.c:131:5: warning: no previous prototype for function 'tmi_tmm_inf_test' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:244:5: warning: no previous prototype for function 'kvm_cvm_create_ttt_levels' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:311:5: warning: no previous prototype for function 'kvm_cvm_populate_par_region' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:70:6: warning: no previous prototype for function 'kvm_cvm_supports_sve' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:75:6: warning: no previous prototype for function 'kvm_cvm_supports_pmu' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:80:5: warning: no previous prototype for function 'kvm_cvm_ipa_limit' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:85:5: warning: no previous prototype for function 'kvm_cvm_get_num_brps' [-Wmissing-prototypes] arch/arm64/kvm/virtcca_cvm.c:90:5: warning: no previous prototype for function 'kvm_cvm_get_num_wrps' [-Wmissing-prototypes] Unverified Error/Warning (likely false positive, please contact us if interested): arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23000000: Unevaluated properties are not allowed ('dma-coherent', 'phy-handle', 'phy-mode', 'power-domains', 'rx-fifo-depth', 'rx-queues-config', 'snps,mtl-rx-config', 'snps,mtl-tx-config', 'snps,pbl', 'snps,ps-speed', 'snps,tso', 'tx-fifo-depth', 'tx-queues-config' were unexpected) arch/arm64/boot/dts/qcom/sa8775p-ride.dtb: ethernet@23040000: Unevaluated properties are not allowed ('dma-coherent', 'mdio', 'phy-handle', 'phy-mode', 'power-domains', 'rx-fifo-depth', 'rx-queues-config', 'snps,mtl-rx-config', 'snps,mtl-tx-config', 'snps,pbl', 'snps,ps-speed', 'snps,tso', 'tx-fifo-depth', 'tx-queues-config' were unexpected) vmlinux.o: warning: objtool: amd_set_spi_freq() falls through to next function amd_spi_busy_wait() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- arm64-defconfig | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- arm64-randconfig-051-20240805 | |-- arch-arm64-boot-dts-qcom-sa8775p-ride.dtb:ethernet:Unevaluated-properties-are-not-allowed-(-dma-coherent-mdio-phy-handle-phy-mode-power-domains-rx-fifo-depth-rx-queues-config-snps-mtl-rx-config-snps-m | `-- arch-arm64-boot-dts-qcom-sa8775p-ride.dtb:ethernet:Unevaluated-properties-are-not-allowed-(-dma-coherent-phy-handle-phy-mode-power-domains-rx-fifo-depth-rx-queues-config-snps-mtl-rx-config-snps-mtl-tx |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-defconfig | |-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument | `-- drivers-char-virtio_console.c:warning:u-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- loongarch-randconfig-001-20240806 | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- x86_64-allyesconfig | `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device |-- x86_64-buildonly-randconfig-006-20240805 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus `-- x86_64-randconfig-161-20240805 `-- vmlinux.o:warning:objtool:amd_set_spi_freq-falls-through-to-next-function-amd_spi_busy_wait() elapsed time: 743m configs tested: 40 configs skipped: 134 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240806 clang-20 arm64 randconfig-002-20240806 clang-20 arm64 randconfig-003-20240806 clang-14 arm64 randconfig-004-20240806 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch defconfig gcc-14.1.0 loongarch randconfig-001-20240806 gcc-14.1.0 loongarch randconfig-002-20240806 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240805 gcc-12 x86_64 buildonly-randconfig-002-20240805 clang-18 x86_64 buildonly-randconfig-003-20240805 clang-18 x86_64 buildonly-randconfig-004-20240805 clang-18 x86_64 buildonly-randconfig-005-20240805 gcc-11 x86_64 buildonly-randconfig-006-20240805 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240805 gcc-12 x86_64 randconfig-002-20240805 gcc-12 x86_64 randconfig-003-20240805 clang-18 x86_64 randconfig-004-20240805 gcc-12 x86_64 randconfig-005-20240805 clang-18 x86_64 randconfig-006-20240805 gcc-12 x86_64 randconfig-011-20240805 clang-18 x86_64 randconfig-012-20240805 clang-18 x86_64 randconfig-013-20240805 gcc-12 x86_64 randconfig-014-20240805 gcc-12 x86_64 randconfig-015-20240805 clang-18 x86_64 randconfig-016-20240805 clang-18 x86_64 randconfig-071-20240805 clang-18 x86_64 randconfig-072-20240805 gcc-12 x86_64 randconfig-073-20240805 clang-18 x86_64 randconfig-074-20240805 clang-18 x86_64 randconfig-075-20240805 clang-18 x86_64 randconfig-076-20240805 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

(no subject)
by fuju 06 Aug '24

06 Aug '24

附件为开源项目tee-gp-proxy: This project aims to provide an implementation for RPC invoking TEE to facilitate the use of Kunpeng confidential computing in cloud scennarios. (gitee.com)<https://gitee.com/openeuler/tee-gp-proxy> 的补丁代码，不涉及秘密信息。

1 0

[PATCH OLK-6.6 0/1] coda part 1
by y00878127 06 Aug '24

06 Aug '24

From: Xiangkai Yang <yangxiangkai(a)huawei.com> virtCCA feature Xiangkai Yang (1): part1 arch/arm64/include/asm/kvm_tmi.h | 93 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 150 +++- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 811 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 175 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + include/linux/iopoll.h | 38 + 11 files changed, 1466 insertions(+), 6 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.27.0

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 06 Aug '24

06 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): part1 arch/arm64/include/asm/kvm_tmi.h | 93 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 150 +++- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 811 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 175 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + drivers/vfio/pci/vfio_pci_core.c | 5 + drivers/vfio/pci/vfio_pci_rdwr.c | 61 ++ drivers/vfio/vfio_iommu_type1.c | 17 + drivers/vfio/vfio_main.c | 18 + include/linux/iommu.h | 9 + include/linux/iopoll.h | 38 + include/linux/pci.h | 4 + include/linux/vfio.h | 5 + include/uapi/linux/vfio.h | 3 + virt/kvm/vfio.c | 121 ++- virt/kvm/vfio.h | 10 + 20 files changed, 1714 insertions(+), 7 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.25.1

1 0

[PATCH openEuler-22.03-LTS-SP1] net/dpaa2: Avoid explicit cpumask var allocation on stack
by Zhang Changzhong 06 Aug '24

06 Aug '24

From: Dawei Li <dawei.li(a)shingroup.cn> stable inclusion from stable-v5.10.221 commit 763896ab62a672d728f5eb10ac90d98c607a8509 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEPB CVE: CVE-2024-42093 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d33fe1714a44ff540629b149d8fab4ac6967585c ] For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow. Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIG_CPUMASK_OFFSTACK. Use *cpumask_var API(s) to address it. Signed-off-by: Dawei Li <dawei.li(a)shingroup.cn> Link: https://lore.kernel.org/r/20240331053441.1276826-3-dawei.li@shingroup.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c index 07ba043..fa202fe 100644 --- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c @@ -2383,11 +2383,14 @@ static int dpaa2_eth_xdp_xmit(struct net_device *net_dev, int n, static int update_xps(struct dpaa2_eth_priv *priv) { struct net_device *net_dev = priv->net_dev; - struct cpumask xps_mask; - struct dpaa2_eth_fq *fq; int i, num_queues, netdev_queues; + struct dpaa2_eth_fq *fq; + cpumask_var_t xps_mask; int err = 0; + if (!alloc_cpumask_var(&xps_mask, GFP_KERNEL)) + return -ENOMEM; + num_queues = dpaa2_eth_queue_count(priv); netdev_queues = (net_dev->num_tc ? : 1) * num_queues; @@ -2397,16 +2400,17 @@ static int update_xps(struct dpaa2_eth_priv *priv) for (i = 0; i < netdev_queues; i++) { fq = &priv->fq[i % num_queues]; - cpumask_clear(&xps_mask); - cpumask_set_cpu(fq->target_cpu, &xps_mask); + cpumask_clear(xps_mask); + cpumask_set_cpu(fq->target_cpu, xps_mask); - err = netif_set_xps_queue(net_dev, &xps_mask, i); + err = netif_set_xps_queue(net_dev, xps_mask, i); if (err) { netdev_warn_once(net_dev, "Error setting XPS queue\n"); break; } } + free_cpumask_var(xps_mask); return err; } -- 2.9.5

2 1

[PATCH OLK-5.10] net/dpaa2: Avoid explicit cpumask var allocation on stack
by Zhang Changzhong 06 Aug '24

06 Aug '24

From: Dawei Li <dawei.li(a)shingroup.cn> stable inclusion from stable-v5.10.221 commit 763896ab62a672d728f5eb10ac90d98c607a8509 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEPB CVE: CVE-2024-42093 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d33fe1714a44ff540629b149d8fab4ac6967585c ] For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow. Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIG_CPUMASK_OFFSTACK. Use *cpumask_var API(s) to address it. Signed-off-by: Dawei Li <dawei.li(a)shingroup.cn> Link: https://lore.kernel.org/r/20240331053441.1276826-3-dawei.li@shingroup.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c index 07ba043..fa202fe 100644 --- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c @@ -2383,11 +2383,14 @@ static int dpaa2_eth_xdp_xmit(struct net_device *net_dev, int n, static int update_xps(struct dpaa2_eth_priv *priv) { struct net_device *net_dev = priv->net_dev; - struct cpumask xps_mask; - struct dpaa2_eth_fq *fq; int i, num_queues, netdev_queues; + struct dpaa2_eth_fq *fq; + cpumask_var_t xps_mask; int err = 0; + if (!alloc_cpumask_var(&xps_mask, GFP_KERNEL)) + return -ENOMEM; + num_queues = dpaa2_eth_queue_count(priv); netdev_queues = (net_dev->num_tc ? : 1) * num_queues; @@ -2397,16 +2400,17 @@ static int update_xps(struct dpaa2_eth_priv *priv) for (i = 0; i < netdev_queues; i++) { fq = &priv->fq[i % num_queues]; - cpumask_clear(&xps_mask); - cpumask_set_cpu(fq->target_cpu, &xps_mask); + cpumask_clear(xps_mask); + cpumask_set_cpu(fq->target_cpu, xps_mask); - err = netif_set_xps_queue(net_dev, &xps_mask, i); + err = netif_set_xps_queue(net_dev, xps_mask, i); if (err) { netdev_warn_once(net_dev, "Error setting XPS queue\n"); break; } } + free_cpumask_var(xps_mask); return err; } -- 2.9.5

2 1

[openeuler:OLK-5.10] BUILD SUCCESS cdac497b81fbc43cdf369eef5d2b98f6df151ebc
by kernel test robot 06 Aug '24

06 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: cdac497b81fbc43cdf369eef5d2b98f6df151ebc !10697 mm: prevent derefencing NULL ptr in pfn_section_valid() elapsed time: 731m configs tested: 35 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240806 clang-20 arm64 randconfig-002-20240806 clang-20 arm64 randconfig-003-20240806 clang-14 arm64 randconfig-004-20240806 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240806 clang-18 x86_64 buildonly-randconfig-002-20240806 clang-18 x86_64 buildonly-randconfig-003-20240806 clang-18 x86_64 buildonly-randconfig-004-20240806 clang-18 x86_64 buildonly-randconfig-005-20240806 gcc-12 x86_64 buildonly-randconfig-006-20240806 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240806 gcc-12 x86_64 randconfig-002-20240806 gcc-11 x86_64 randconfig-003-20240806 gcc-12 x86_64 randconfig-004-20240806 clang-18 x86_64 randconfig-005-20240806 clang-18 x86_64 randconfig-006-20240806 clang-18 x86_64 randconfig-011-20240806 gcc-12 x86_64 randconfig-012-20240806 gcc-12 x86_64 randconfig-013-20240806 clang-18 x86_64 randconfig-014-20240806 gcc-12 x86_64 randconfig-015-20240806 gcc-12 x86_64 randconfig-016-20240806 gcc-12 x86_64 randconfig-071-20240806 gcc-12 x86_64 randconfig-072-20240806 clang-18 x86_64 randconfig-073-20240806 gcc-11 x86_64 randconfig-074-20240806 gcc-12 x86_64 randconfig-075-20240806 gcc-12 x86_64 randconfig-076-20240806 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
by Yu Liao 06 Aug '24

06 Aug '24

From: Ferry Meng <mengferry(a)linux.alibaba.com> mainline inclusion from mainline-v6.11-rc1 commit af77c4fc1871847b528d58b7fdafb4aa1f6a9262 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAG8SI CVE: CVE-2024-41016 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images. Link: https://lkml.kernel.org/r/20240520024024.1976129-2-joseph.qi@linux.alibaba.… Signed-off-by: Ferry Meng <mengferry(a)linux.alibaba.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: lei lu <llfamsec(a)gmail.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Mark Fasheh <mark(a)fasheh.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- fs/ocfs2/xattr.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 10df2e1dfef7..fbbb2a88ffec 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -1074,7 +1074,7 @@ static int ocfs2_xattr_find_entry(int name_index, { struct ocfs2_xattr_entry *entry; size_t name_len; - int i, cmp = 1; + int i, name_offset, cmp = 1; if (name == NULL) return -EINVAL; @@ -1085,10 +1085,15 @@ static int ocfs2_xattr_find_entry(int name_index, cmp = name_index - ocfs2_xattr_get_type(entry); if (!cmp) cmp = name_len - entry->xe_name_len; - if (!cmp) - cmp = memcmp(name, (xs->base + - le16_to_cpu(entry->xe_name_offset)), - name_len); + if (!cmp) { + name_offset = le16_to_cpu(entry->xe_name_offset); + if ((xs->base + name_offset + name_len) > xs->end) { + ocfs2_error(inode->i_sb, + "corrupted xattr entries"); + return -EFSCORRUPTED; + } + cmp = memcmp(name, (xs->base + name_offset), name_len); + } if (cmp == 0) break; entry += 1; -- 2.25.1

2 1

[PATCH OLK-5.10] ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
by Yu Liao 06 Aug '24

06 Aug '24

From: Ferry Meng <mengferry(a)linux.alibaba.com> mainline inclusion from mainline-v6.11-rc1 commit af77c4fc1871847b528d58b7fdafb4aa1f6a9262 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAG8SI CVE: CVE-2024-41016 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images. Link: https://lkml.kernel.org/r/20240520024024.1976129-2-joseph.qi@linux.alibaba.… Signed-off-by: Ferry Meng <mengferry(a)linux.alibaba.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: lei lu <llfamsec(a)gmail.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Mark Fasheh <mark(a)fasheh.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- fs/ocfs2/xattr.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 10df2e1dfef7..fbbb2a88ffec 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -1074,7 +1074,7 @@ static int ocfs2_xattr_find_entry(int name_index, { struct ocfs2_xattr_entry *entry; size_t name_len; - int i, cmp = 1; + int i, name_offset, cmp = 1; if (name == NULL) return -EINVAL; @@ -1085,10 +1085,15 @@ static int ocfs2_xattr_find_entry(int name_index, cmp = name_index - ocfs2_xattr_get_type(entry); if (!cmp) cmp = name_len - entry->xe_name_len; - if (!cmp) - cmp = memcmp(name, (xs->base + - le16_to_cpu(entry->xe_name_offset)), - name_len); + if (!cmp) { + name_offset = le16_to_cpu(entry->xe_name_offset); + if ((xs->base + name_offset + name_len) > xs->end) { + ocfs2_error(inode->i_sb, + "corrupted xattr entries"); + return -EFSCORRUPTED; + } + cmp = memcmp(name, (xs->base + name_offset), name_len); + } if (cmp == 0) break; entry += 1; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] filelock: Remove locks reliably when fcntl/close race is detected
by Long Li 06 Aug '24

06 Aug '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.222 commit 5661b9c7ec189406c2dde00837aaa4672efb6240 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAF3IR CVE: CVE-2024-41012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 3cad1bc010416c6dd780643476bc59ed742436b9 upstream. When fcntl_setlk() races with close(), it removes the created lock with do_lock_file_wait(). However, LSMs can allow the first do_lock_file_wait() that created the lock while denying the second do_lock_file_wait() that tries to remove the lock. In theory (but AFAIK not in practice), posix_lock_file() could also fail to remove a lock due to GFP_KERNEL allocation failure (when splitting a range in the middle). After the bug has been triggered, use-after-free reads will occur in lock_get_status() when userspace reads /proc/locks. This can likely be used to read arbitrary kernel memory, but can't corrupt kernel memory. This only affects systems with SELinux / Smack / AppArmor / BPF-LSM in enforcing mode and only works from some security contexts. Fix it by calling locks_remove_posix() instead, which is designed to reliably get rid of POSIX locks associated with the given file and files_struct and is also used by filp_flush(). Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling") Cc: stable(a)kernel.org Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563 Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20240702-fs-lock-recover-2-v1-1-edd456f63789@goog… Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Christian Brauner <brauner(a)kernel.org> [stable fixup: ->c.flc_type was ->fl_type in older kernels] Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/locks.c [Conflicts due to function refactor in fcntl_setlk()] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/locks.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index 6280fbb613de..6bd1fbe42ada 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2530,8 +2530,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, error = do_lock_file_wait(filp, cmd, file_lock); /* - * Attempt to detect a close/fcntl race and recover by releasing the - * lock that was just acquired. There is no need to do that when we're + * Detect close/fcntl races and recover by zapping all POSIX locks + * associated with this file and our files_struct, just like on + * filp_flush(). There is no need to do that when we're * unlocking though, or for OFD locks. */ if (!error && file_lock->fl_type != F_UNLCK && @@ -2545,9 +2546,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, f = fcheck(fd); spin_unlock(&current->files->file_lock); if (f != filp) { - file_lock->fl_type = F_UNLCK; - error = do_lock_file_wait(filp, cmd, file_lock); - WARN_ON_ONCE(error); + locks_remove_posix(filp, current->files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH OLK-5.10] filelock: Remove locks reliably when fcntl/close race is detected
by Long Li 06 Aug '24

06 Aug '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.222 commit 5661b9c7ec189406c2dde00837aaa4672efb6240 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAF3IR CVE: CVE-2024-41012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 3cad1bc010416c6dd780643476bc59ed742436b9 upstream. When fcntl_setlk() races with close(), it removes the created lock with do_lock_file_wait(). However, LSMs can allow the first do_lock_file_wait() that created the lock while denying the second do_lock_file_wait() that tries to remove the lock. In theory (but AFAIK not in practice), posix_lock_file() could also fail to remove a lock due to GFP_KERNEL allocation failure (when splitting a range in the middle). After the bug has been triggered, use-after-free reads will occur in lock_get_status() when userspace reads /proc/locks. This can likely be used to read arbitrary kernel memory, but can't corrupt kernel memory. This only affects systems with SELinux / Smack / AppArmor / BPF-LSM in enforcing mode and only works from some security contexts. Fix it by calling locks_remove_posix() instead, which is designed to reliably get rid of POSIX locks associated with the given file and files_struct and is also used by filp_flush(). Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling") Cc: stable(a)kernel.org Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563 Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20240702-fs-lock-recover-2-v1-1-edd456f63789@goog… Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Christian Brauner <brauner(a)kernel.org> [stable fixup: ->c.flc_type was ->fl_type in older kernels] Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/locks.c [Conflicts due to function refactor in fcntl_setlk()] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/locks.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index 6f27ec4f58da..5549b5a54ffd 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2530,8 +2530,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, error = do_lock_file_wait(filp, cmd, file_lock); /* - * Attempt to detect a close/fcntl race and recover by releasing the - * lock that was just acquired. There is no need to do that when we're + * Detect close/fcntl races and recover by zapping all POSIX locks + * associated with this file and our files_struct, just like on + * filp_flush(). There is no need to do that when we're * unlocking though, or for OFD locks. */ if (!error && file_lock->fl_type != F_UNLCK && @@ -2545,9 +2546,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, f = fcheck(fd); spin_unlock(&current->files->file_lock); if (f != filp) { - file_lock->fl_type = F_UNLCK; - error = do_lock_file_wait(filp, cmd, file_lock); - WARN_ON_ONCE(error); + locks_remove_posix(filp, current->files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 06 Aug '24

06 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): part1 arch/arm64/include/asm/kvm_tmi.h | 93 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 150 +++- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 811 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 175 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + drivers/vfio/pci/vfio_pci_core.c | 5 + drivers/vfio/pci/vfio_pci_rdwr.c | 61 ++ drivers/vfio/vfio_iommu_type1.c | 17 + drivers/vfio/vfio_main.c | 18 + include/linux/iommu.h | 9 + include/linux/iopoll.h | 38 + include/linux/pci.h | 4 + include/linux/vfio.h | 5 + include/uapi/linux/vfio.h | 3 + virt/kvm/vfio.c | 121 ++- virt/kvm/vfio.h | 10 + 20 files changed, 1714 insertions(+), 7 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.25.1

1 1

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 06 Aug '24

06 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): smmu secure init arch/arm64/include/asm/kvm_tmi.h | 93 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 150 +++- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 811 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 175 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + include/linux/iopoll.h | 38 + 11 files changed, 1466 insertions(+), 6 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.25.1

2 2

[openeuler:OLK-6.6 12414/13217] arch/arm64/kvm/arm.c:138:7: warning: variable 'r' is used uninitialized whenever 'if' condition is false
by kernel test robot 06 Aug '24

06 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d59a335bf0dd2aac9debe211a0a07fbeaf605fed commit: 67e11ee6347c43a97e8987b03a5b3534cd8095d9 [12414/13217] kvm: add virtcca cvm host feature config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240806/202408060639.d1BhjbnX-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 423aec6573df4424f90555468128e17073ddc69e) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240806/202408060639.d1BhjbnX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408060639.d1BhjbnX-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/kvm/arm.c:9: In file included from include/linux/entry-kvm.h:6: In file included from include/linux/resume_user_mode.h:8: In file included from include/linux/memcontrol.h:20: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/arm.c:138:7: warning: variable 'r' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 138 | if (static_branch_unlikely(&virtcca_cvm_is_available)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/jump_label.h:504:40: note: expanded from macro 'static_branch_unlikely' 504 | #define static_branch_unlikely(x) \ | ^ 505 | ({ \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 506 | bool branch; \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 507 | if (__builtin_types_compatible_p(typeof(*x), struct static_key_true)) \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 508 | branch = arch_static_branch_jump(&(x)->key, false); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 509 | else if (__builtin_types_compatible_p(typeof(*x), struct static_key_false)) \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 510 | branch = arch_static_branch(&(x)->key, false); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 511 | else \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 512 | branch = ____wrong_branch_error(); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 513 | unlikely_notrace(branch); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 514 | }) | ~~ arch/arm64/kvm/arm.c:147:9: note: uninitialized use occurs here 147 | return r; | ^ arch/arm64/kvm/arm.c:138:3: note: remove the 'if' if its condition is always true 138 | if (static_branch_unlikely(&virtcca_cvm_is_available)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 139 | r = kvm_cvm_enable_cap(kvm, cap); arch/arm64/kvm/arm.c:92:7: note: initialize the variable 'r' to silence this warning 92 | int r; | ^ | = 0 6 warnings generated. -- In file included from arch/arm64/kvm/tmi.c:6: In file included from arch/arm64/include/asm/kvm_tmi.h:8: In file included from include/linux/kvm_host.h:16: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/tmi.c:131:5: warning: no previous prototype for function 'tmi_tmm_inf_test' [-Wmissing-prototypes] 131 | u64 tmi_tmm_inf_test(u64 x1, u64 x2, u64 x3, u64 x4, u64 x5) | ^ arch/arm64/kvm/tmi.c:131:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 131 | u64 tmi_tmm_inf_test(u64 x1, u64 x2, u64 x3, u64 x4, u64 x5) | ^ | static 6 warnings generated. -- In file included from arch/arm64/kvm/virtcca_cvm.c:5: In file included from include/linux/kvm_host.h:16: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/virtcca_cvm.c:70:6: warning: no previous prototype for function 'kvm_cvm_supports_sve' [-Wmissing-prototypes] 70 | bool kvm_cvm_supports_sve(void) | ^ arch/arm64/kvm/virtcca_cvm.c:70:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 70 | bool kvm_cvm_supports_sve(void) | ^ | static >> arch/arm64/kvm/virtcca_cvm.c:75:6: warning: no previous prototype for function 'kvm_cvm_supports_pmu' [-Wmissing-prototypes] 75 | bool kvm_cvm_supports_pmu(void) | ^ arch/arm64/kvm/virtcca_cvm.c:75:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 75 | bool kvm_cvm_supports_pmu(void) | ^ | static >> arch/arm64/kvm/virtcca_cvm.c:80:5: warning: no previous prototype for function 'kvm_cvm_ipa_limit' [-Wmissing-prototypes] 80 | u32 kvm_cvm_ipa_limit(void) | ^ arch/arm64/kvm/virtcca_cvm.c:80:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 80 | u32 kvm_cvm_ipa_limit(void) | ^ | static >> arch/arm64/kvm/virtcca_cvm.c:85:5: warning: no previous prototype for function 'kvm_cvm_get_num_brps' [-Wmissing-prototypes] 85 | u32 kvm_cvm_get_num_brps(void) | ^ arch/arm64/kvm/virtcca_cvm.c:85:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 85 | u32 kvm_cvm_get_num_brps(void) | ^ | static >> arch/arm64/kvm/virtcca_cvm.c:90:5: warning: no previous prototype for function 'kvm_cvm_get_num_wrps' [-Wmissing-prototypes] 90 | u32 kvm_cvm_get_num_wrps(void) | ^ arch/arm64/kvm/virtcca_cvm.c:90:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 90 | u32 kvm_cvm_get_num_wrps(void) | ^ | static >> arch/arm64/kvm/virtcca_cvm.c:244:5: warning: no previous prototype for function 'kvm_cvm_create_ttt_levels' [-Wmissing-prototypes] 244 | int kvm_cvm_create_ttt_levels(struct kvm *kvm, struct virtcca_cvm *cvm, | ^ arch/arm64/kvm/virtcca_cvm.c:244:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 244 | int kvm_cvm_create_ttt_levels(struct kvm *kvm, struct virtcca_cvm *cvm, | ^ | static >> arch/arm64/kvm/virtcca_cvm.c:311:5: warning: no previous prototype for function 'kvm_cvm_populate_par_region' [-Wmissing-prototypes] 311 | int kvm_cvm_populate_par_region(struct kvm *kvm, u64 numa_set, | ^ arch/arm64/kvm/virtcca_cvm.c:311:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 311 | int kvm_cvm_populate_par_region(struct kvm *kvm, u64 numa_set, | ^ | static 12 warnings generated. vim +138 arch/arm64/kvm/arm.c 88 89 int kvm_vm_ioctl_enable_cap(struct kvm *kvm, 90 struct kvm_enable_cap *cap) 91 { 92 int r; 93 u64 new_cap; 94 95 if (cap->flags) 96 return -EINVAL; 97 98 switch (cap->cap) { 99 case KVM_CAP_ARM_NISV_TO_USER: 100 r = 0; 101 set_bit(KVM_ARCH_FLAG_RETURN_NISV_IO_ABORT_TO_USER, 102 &kvm->arch.flags); 103 break; 104 case KVM_CAP_ARM_MTE: 105 mutex_lock(&kvm->lock); 106 if (!system_supports_mte() || kvm->created_vcpus) { 107 r = -EINVAL; 108 } else { 109 r = 0; 110 set_bit(KVM_ARCH_FLAG_MTE_ENABLED, &kvm->arch.flags); 111 } 112 mutex_unlock(&kvm->lock); 113 break; 114 case KVM_CAP_ARM_SYSTEM_SUSPEND: 115 r = 0; 116 set_bit(KVM_ARCH_FLAG_SYSTEM_SUSPEND_ENABLED, &kvm->arch.flags); 117 break; 118 case KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE: 119 new_cap = cap->args[0]; 120 121 mutex_lock(&kvm->slots_lock); 122 /* 123 * To keep things simple, allow changing the chunk 124 * size only when no memory slots have been created. 125 */ 126 if (!kvm_are_all_memslots_empty(kvm)) { 127 r = -EINVAL; 128 } else if (new_cap && !kvm_is_block_size_supported(new_cap)) { 129 r = -EINVAL; 130 } else { 131 r = 0; 132 kvm->arch.mmu.split_page_chunk_size = new_cap; 133 } 134 mutex_unlock(&kvm->slots_lock); 135 break; 136 #ifdef CONFIG_HISI_VIRTCCA_HOST 137 case KVM_CAP_ARM_TMM: > 138 if (static_branch_unlikely(&virtcca_cvm_is_available)) 139 r = kvm_cvm_enable_cap(kvm, cap); 140 break; 141 #endif 142 default: 143 r = -EINVAL; 144 break; 145 } 146 147 return r; 148 } 149 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13192/23440] drivers/crypto/hisilicon/rde/rde_main.c:576:6: warning: no previous prototype for 'hisi_rde_hw_error_log'
by kernel test robot 06 Aug '24

06 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f10f25f5188cddb47d7a8a4ddf63c200b33e5b49 commit: 73d33f5c59dc3824444baca6a458427f4de3d8fa [13192/23440] qm: Move all the same logic functions of hisilicon crypto to qm config: arm64-randconfig-002-20240806 (https://download.01.org/0day-ci/archive/20240806/202408060608.ESB5dO3f-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240806/202408060608.ESB5dO3f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408060608.ESB5dO3f-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/hisilicon/rde/rde_main.c:576:6: warning: no previous prototype for 'hisi_rde_hw_error_log' [-Wmissing-prototypes] 576 | void hisi_rde_hw_error_log(struct hisi_qm *qm, u32 err_sts) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/crypto/hisilicon/rde/rde_main.c:607:5: warning: no previous prototype for 'hisi_rde_get_hw_err_status' [-Wmissing-prototypes] 607 | u32 hisi_rde_get_hw_err_status(struct hisi_qm *qm) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/crypto/hisilicon/rde/rde_main.c:612:6: warning: no previous prototype for 'hisi_rde_clear_hw_err_status' [-Wmissing-prototypes] 612 | void hisi_rde_clear_hw_err_status(struct hisi_qm *qm, u32 err_sts) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/hisi_rde_hw_error_log +576 drivers/crypto/hisilicon/rde/rde_main.c 575 > 576 void hisi_rde_hw_error_log(struct hisi_qm *qm, u32 err_sts) 577 { 578 const struct hisi_rde_hw_error *err = rde_hw_error; 579 struct device *dev = &qm->pdev->dev; 580 u32 err_val; 581 582 while (err->msg) { 583 if (err->int_msk & err_sts) 584 dev_err_ratelimited(dev, 585 "[%s] [Error status=0x%x] found.\n", 586 err->msg, err->int_msk); 587 err++; 588 } 589 590 if (HRDE_ECC_2BIT_ERR & err_sts) { 591 err_val = (readl(qm->io_base + HRDE_ERR_CNT) & 592 HRDE_ECC_2BIT_CNT_MSK); 593 dev_err_ratelimited(dev, 594 "Rde ecc 2bit sram num=0x%x.\n", err_val); 595 } 596 597 if (HRDE_STATE_INT_ERR & err_sts) { 598 err_val = readl(qm->io_base + HRDE_AM_CURR_PORT_STS); 599 dev_err_ratelimited(dev, 600 "Rde ooo cur port sts=0x%x.\n", err_val); 601 err_val = readl(qm->io_base + HRDE_MASTER_TRANS_RET); 602 dev_err_ratelimited(dev, 603 "Rde ooo outstanding sts=0x%x.\n", err_val); 604 } 605 } 606 > 607 u32 hisi_rde_get_hw_err_status(struct hisi_qm *qm) 608 { 609 return readl(qm->io_base + HRDE_INT_STATUS); 610 } 611 > 612 void hisi_rde_clear_hw_err_status(struct hisi_qm *qm, u32 err_sts) 613 { 614 writel(err_sts, qm->io_base + HRDE_INT_SOURCE); 615 } 616 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 05 Aug '24

05 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): smmu secure init arch/arm64/include/asm/kvm_tmi.h | 81 +- arch/arm64/include/asm/kvm_tmm.h | 22 + arch/arm64/kvm/tmi.c | 140 ++- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 1 + drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c | 809 ++++++++++++++++++ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h | 160 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 178 +++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 16 + include/linux/iommu.h | 4 + include/linux/iopoll.h | 38 + 11 files changed, 1446 insertions(+), 5 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.h -- 2.25.1

2 2

[PATCH OLK-6.6] filelock: Remove locks reliably when fcntl/close race is detected
by Long Li 05 Aug '24

05 Aug '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.41 commit 5f5d0799eb0a01d550c21b7894e26b2d9db55763 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAF3IR CVE: CVE-2024-41012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 3cad1bc010416c6dd780643476bc59ed742436b9 upstream. When fcntl_setlk() races with close(), it removes the created lock with do_lock_file_wait(). However, LSMs can allow the first do_lock_file_wait() that created the lock while denying the second do_lock_file_wait() that tries to remove the lock. In theory (but AFAIK not in practice), posix_lock_file() could also fail to remove a lock due to GFP_KERNEL allocation failure (when splitting a range in the middle). After the bug has been triggered, use-after-free reads will occur in lock_get_status() when userspace reads /proc/locks. This can likely be used to read arbitrary kernel memory, but can't corrupt kernel memory. This only affects systems with SELinux / Smack / AppArmor / BPF-LSM in enforcing mode and only works from some security contexts. Fix it by calling locks_remove_posix() instead, which is designed to reliably get rid of POSIX locks associated with the given file and files_struct and is also used by filp_flush(). Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling") Cc: stable(a)kernel.org Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563 Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20240702-fs-lock-recover-2-v1-1-edd456f63789@goog… Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Christian Brauner <brauner(a)kernel.org> [stable fixup: ->c.flc_type was ->fl_type in older kernels] Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/locks.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index 76ad05f8070a..a7df032d0437 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2381,8 +2381,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, error = do_lock_file_wait(filp, cmd, file_lock); /* - * Attempt to detect a close/fcntl race and recover by releasing the - * lock that was just acquired. There is no need to do that when we're + * Detect close/fcntl races and recover by zapping all POSIX locks + * associated with this file and our files_struct, just like on + * filp_flush(). There is no need to do that when we're * unlocking though, or for OFD locks. */ if (!error && file_lock->fl_type != F_UNLCK && @@ -2397,9 +2398,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, f = files_lookup_fd_locked(files, fd); spin_unlock(&files->file_lock); if (f != filp) { - file_lock->fl_type = F_UNLCK; - error = do_lock_file_wait(filp, cmd, file_lock); - WARN_ON_ONCE(error); + locks_remove_posix(filp, files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] filelock: Remove locks reliably when fcntl/close race is detected
by Long Li 05 Aug '24

05 Aug '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v4.19.316 commit d30ff33040834c3b9eee29740acd92f9c7ba2250 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAF3IR CVE: CVE-2024-41012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 3cad1bc010416c6dd780643476bc59ed742436b9 upstream. When fcntl_setlk() races with close(), it removes the created lock with do_lock_file_wait(). However, LSMs can allow the first do_lock_file_wait() that created the lock while denying the second do_lock_file_wait() that tries to remove the lock. In theory (but AFAIK not in practice), posix_lock_file() could also fail to remove a lock due to GFP_KERNEL allocation failure (when splitting a range in the middle). After the bug has been triggered, use-after-free reads will occur in lock_get_status() when userspace reads /proc/locks. This can likely be used to read arbitrary kernel memory, but can't corrupt kernel memory. This only affects systems with SELinux / Smack / AppArmor / BPF-LSM in enforcing mode and only works from some security contexts. Fix it by calling locks_remove_posix() instead, which is designed to reliably get rid of POSIX locks associated with the given file and files_struct and is also used by filp_flush(). Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling") Cc: stable(a)kernel.org Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563 Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20240702-fs-lock-recover-2-v1-1-edd456f63789@goog… Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Christian Brauner <brauner(a)kernel.org> [stable fixup: ->c.flc_type was ->fl_type in older kernels] Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/locks.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index 9dc72fda5e4e..557568e03188 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2298,8 +2298,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, error = do_lock_file_wait(filp, cmd, file_lock); /* - * Attempt to detect a close/fcntl race and recover by releasing the - * lock that was just acquired. There is no need to do that when we're + * Detect close/fcntl races and recover by zapping all POSIX locks + * associated with this file and our files_struct, just like on + * filp_flush(). There is no need to do that when we're * unlocking though, or for OFD locks. */ if (!error && file_lock->fl_type != F_UNLCK && @@ -2313,9 +2314,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, f = fcheck(fd); spin_unlock(&current->files->file_lock); if (f != filp) { - file_lock->fl_type = F_UNLCK; - error = do_lock_file_wait(filp, cmd, file_lock); - WARN_ON_ONCE(error); + locks_remove_posix(filp, &current->files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Backport vmalloc 2 bugfix
by Peng Zhang 05 Aug '24

05 Aug '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport vmalloc 2 bugfix for OLK-6.6. Uladzislau Rezki (Sony) (1): mm: vmalloc: fix lockdep warning rulinhuang (1): mm/vmalloc: eliminated the lock contention from twice to once mm/vmalloc.c | 123 +++++++++++++++++++++++++++------------------------ 1 file changed, 65 insertions(+), 58 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] net/iucv: Avoid explicit cpumask var allocation on stack
by Zhang Changzhong 05 Aug '24

05 Aug '24

From: Dawei Li <dawei.li(a)shingroup.cn> stable inclusion from stable-v5.10.221 commit 9dadab0db7d904413ea1cdaa13f127da05c31e71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP9 CVE: CVE-2024-42094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be4e1304419c99a164b4c0e101c7c2a756b635b9 ] For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow. Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIG_CPUMASK_OFFSTACK. Use *cpumask_var API(s) to address it. Signed-off-by: Dawei Li <dawei.li(a)shingroup.cn> Reviewed-by: Alexandra Winter <wintera(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240331053441.1276826-2-dawei.li@shingroup.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/iucv/iucv.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c index 349c6ac..da8213b 100644 --- a/net/iucv/iucv.c +++ b/net/iucv/iucv.c @@ -517,7 +517,7 @@ static void iucv_setmask_mp(void) */ static void iucv_setmask_up(void) { - cpumask_t cpumask; + static cpumask_t cpumask; int cpu; /* Disable all cpu but the first in cpu_irq_cpumask. */ @@ -625,23 +625,33 @@ static int iucv_cpu_online(unsigned int cpu) static int iucv_cpu_down_prep(unsigned int cpu) { - cpumask_t cpumask; + cpumask_var_t cpumask; + int ret = 0; if (!iucv_path_table) return 0; - cpumask_copy(&cpumask, &iucv_buffer_cpumask); - cpumask_clear_cpu(cpu, &cpumask); - if (cpumask_empty(&cpumask)) + if (!alloc_cpumask_var(&cpumask, GFP_KERNEL)) + return -ENOMEM; + + cpumask_copy(cpumask, &iucv_buffer_cpumask); + cpumask_clear_cpu(cpu, cpumask); + if (cpumask_empty(cpumask)) { /* Can't offline last IUCV enabled cpu. */ - return -EINVAL; + ret = -EINVAL; + goto __free_cpumask; + } iucv_retrieve_cpu(NULL); if (!cpumask_empty(&iucv_irq_cpumask)) - return 0; + goto __free_cpumask; + smp_call_function_single(cpumask_first(&iucv_buffer_cpumask), iucv_allow_cpu, NULL, 1); - return 0; + +__free_cpumask: + free_cpumask_var(cpumask); + return ret; } /** -- 2.9.5

2 1

[PATCH OLK-5.10] net/iucv: Avoid explicit cpumask var allocation on stack
by Zhang Changzhong 05 Aug '24

05 Aug '24

From: Dawei Li <dawei.li(a)shingroup.cn> stable inclusion from stable-v5.10.221 commit 9dadab0db7d904413ea1cdaa13f127da05c31e71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP9 CVE: CVE-2024-42094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be4e1304419c99a164b4c0e101c7c2a756b635b9 ] For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow. Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIG_CPUMASK_OFFSTACK. Use *cpumask_var API(s) to address it. Signed-off-by: Dawei Li <dawei.li(a)shingroup.cn> Reviewed-by: Alexandra Winter <wintera(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240331053441.1276826-2-dawei.li@shingroup.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/iucv/iucv.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c index 6f84978..9d6449f 100644 --- a/net/iucv/iucv.c +++ b/net/iucv/iucv.c @@ -517,7 +517,7 @@ static void iucv_setmask_mp(void) */ static void iucv_setmask_up(void) { - cpumask_t cpumask; + static cpumask_t cpumask; int cpu; /* Disable all cpu but the first in cpu_irq_cpumask. */ @@ -625,23 +625,33 @@ static int iucv_cpu_online(unsigned int cpu) static int iucv_cpu_down_prep(unsigned int cpu) { - cpumask_t cpumask; + cpumask_var_t cpumask; + int ret = 0; if (!iucv_path_table) return 0; - cpumask_copy(&cpumask, &iucv_buffer_cpumask); - cpumask_clear_cpu(cpu, &cpumask); - if (cpumask_empty(&cpumask)) + if (!alloc_cpumask_var(&cpumask, GFP_KERNEL)) + return -ENOMEM; + + cpumask_copy(cpumask, &iucv_buffer_cpumask); + cpumask_clear_cpu(cpu, cpumask); + if (cpumask_empty(cpumask)) { /* Can't offline last IUCV enabled cpu. */ - return -EINVAL; + ret = -EINVAL; + goto __free_cpumask; + } iucv_retrieve_cpu(NULL); if (!cpumask_empty(&iucv_irq_cpumask)) - return 0; + goto __free_cpumask; + smp_call_function_single(cpumask_first(&iucv_buffer_cpumask), iucv_allow_cpu, NULL, 1); - return 0; + +__free_cpumask: + free_cpumask_var(cpumask); + return ret; } /** -- 2.9.5

2 1

[PATCH OLK-5.10 v2 0/3] blk-wbt: don't throttle swap writes in direct reclaim
by Yu Kuai 05 Aug '24

05 Aug '24

Baokun Li (1): blk-wbt: don't throttle swap writes in direct reclaim Christoph Hellwig (1): blk-wbt: move private information from blk-wbt.h to blk-wbt.c Tom Rix (1): blk-wbt: remove wbt_track stub block/blk-mq-sched.c | 1 + block/blk-settings.c | 1 + block/blk-sysfs.c | 1 + block/blk-wbt.c | 91 ++++++++++++++++++++++++++++++++++++++++---- block/blk-wbt.h | 89 ------------------------------------------- block/elevator.c | 1 + 6 files changed, 88 insertions(+), 96 deletions(-) -- 2.39.2

2 4

[PATCH OLK-5.10] scsi: qedf: Make qedf_execute_tmf() non-preemptible
by Yu Liao 05 Aug '24

05 Aug '24

From: John Meneghini <jmeneghi(a)redhat.com> stable inclusion from stable-v5.10.222 commit 5ceb40cdee721e13cbe15a0515cacf984e11236b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGTJ2 CVE: CVE-2024-42124 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0d8b637c9c5eeaa1a4e3dfb336f3ff918eb64fec ] Stop calling smp_processor_id() from preemptible code in qedf_execute_tmf90. This results in BUG_ON() when running an RT kernel. [ 659.343280] BUG: using smp_processor_id() in preemptible [00000000] code: sg_reset/3646 [ 659.343282] caller is qedf_execute_tmf+0x8b/0x360 [qedf] Tested-by: Guangwu Zhang <guazhang(a)redhat.com> Cc: Saurav Kashyap <skashyap(a)marvell.com> Cc: Nilesh Javali <njavali(a)marvell.com> Signed-off-by: John Meneghini <jmeneghi(a)redhat.com> Link: https://lore.kernel.org/r/20240403150155.412954-1-jmeneghi@redhat.com Acked-by: Saurav Kashyap <skashyap(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/scsi/qedf/qedf_io.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c index 1f8e81296beb..70f920f4b7a1 100644 --- a/drivers/scsi/qedf/qedf_io.c +++ b/drivers/scsi/qedf/qedf_io.c @@ -2351,9 +2351,6 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, struct scsi_cmnd *sc_cmd, io_req->fcport = fcport; io_req->cmd_type = QEDF_TASK_MGMT_CMD; - /* Record which cpu this request is associated with */ - io_req->cpu = smp_processor_id(); - /* Set TM flags */ io_req->io_req_flags = QEDF_READ; io_req->data_xfer_len = 0; @@ -2375,6 +2372,9 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, struct scsi_cmnd *sc_cmd, spin_lock_irqsave(&fcport->rport_lock, flags); + /* Record which cpu this request is associated with */ + io_req->cpu = smp_processor_id(); + sqe_idx = qedf_get_sqe_idx(fcport); sqe = &fcport->sq[sqe_idx]; memset(sqe, 0, sizeof(struct fcoe_wqe)); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] scsi: qedf: Make qedf_execute_tmf() non-preemptible
by Yu Liao 05 Aug '24

05 Aug '24

From: John Meneghini <jmeneghi(a)redhat.com> stable inclusion from stable-v5.10.222 commit 5ceb40cdee721e13cbe15a0515cacf984e11236b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGTJ2 CVE: CVE-2024-42124 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0d8b637c9c5eeaa1a4e3dfb336f3ff918eb64fec ] Stop calling smp_processor_id() from preemptible code in qedf_execute_tmf90. This results in BUG_ON() when running an RT kernel. [ 659.343280] BUG: using smp_processor_id() in preemptible [00000000] code: sg_reset/3646 [ 659.343282] caller is qedf_execute_tmf+0x8b/0x360 [qedf] Tested-by: Guangwu Zhang <guazhang(a)redhat.com> Cc: Saurav Kashyap <skashyap(a)marvell.com> Cc: Nilesh Javali <njavali(a)marvell.com> Signed-off-by: John Meneghini <jmeneghi(a)redhat.com> Link: https://lore.kernel.org/r/20240403150155.412954-1-jmeneghi@redhat.com Acked-by: Saurav Kashyap <skashyap(a)marvell.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/scsi/qedf/qedf_io.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c index 1f8e81296beb..70f920f4b7a1 100644 --- a/drivers/scsi/qedf/qedf_io.c +++ b/drivers/scsi/qedf/qedf_io.c @@ -2351,9 +2351,6 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, struct scsi_cmnd *sc_cmd, io_req->fcport = fcport; io_req->cmd_type = QEDF_TASK_MGMT_CMD; - /* Record which cpu this request is associated with */ - io_req->cpu = smp_processor_id(); - /* Set TM flags */ io_req->io_req_flags = QEDF_READ; io_req->data_xfer_len = 0; @@ -2375,6 +2372,9 @@ static int qedf_execute_tmf(struct qedf_rport *fcport, struct scsi_cmnd *sc_cmd, spin_lock_irqsave(&fcport->rport_lock, flags); + /* Record which cpu this request is associated with */ + io_req->cpu = smp_processor_id(); + sqe_idx = qedf_get_sqe_idx(fcport); sqe = &fcport->sq[sqe_idx]; memset(sqe, 0, sizeof(struct fcoe_wqe)); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net/iucv: Avoid explicit cpumask var allocation on stack
by Zhang Changzhong 05 Aug '24

05 Aug '24

From: Dawei Li <dawei.li(a)shingroup.cn> stable inclusion from stable-v4.19.317 commit 2b085521be5292016097b5e7ca81b26be3f7098d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEP9 CVE: CVE-2024-42094 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit be4e1304419c99a164b4c0e101c7c2a756b635b9 ] For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow. Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIG_CPUMASK_OFFSTACK. Use *cpumask_var API(s) to address it. Signed-off-by: Dawei Li <dawei.li(a)shingroup.cn> Reviewed-by: Alexandra Winter <wintera(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240331053441.1276826-2-dawei.li@shingroup.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/iucv/iucv.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c index eb502c6..aed216f 100644 --- a/net/iucv/iucv.c +++ b/net/iucv/iucv.c @@ -578,7 +578,7 @@ static void iucv_setmask_mp(void) */ static void iucv_setmask_up(void) { - cpumask_t cpumask; + static cpumask_t cpumask; int cpu; /* Disable all cpu but the first in cpu_irq_cpumask. */ @@ -686,23 +686,33 @@ static int iucv_cpu_online(unsigned int cpu) static int iucv_cpu_down_prep(unsigned int cpu) { - cpumask_t cpumask; + cpumask_var_t cpumask; + int ret = 0; if (!iucv_path_table) return 0; - cpumask_copy(&cpumask, &iucv_buffer_cpumask); - cpumask_clear_cpu(cpu, &cpumask); - if (cpumask_empty(&cpumask)) + if (!alloc_cpumask_var(&cpumask, GFP_KERNEL)) + return -ENOMEM; + + cpumask_copy(cpumask, &iucv_buffer_cpumask); + cpumask_clear_cpu(cpu, cpumask); + if (cpumask_empty(cpumask)) { /* Can't offline last IUCV enabled cpu. */ - return -EINVAL; + ret = -EINVAL; + goto __free_cpumask; + } iucv_retrieve_cpu(NULL); if (!cpumask_empty(&iucv_irq_cpumask)) - return 0; + goto __free_cpumask; + smp_call_function_single(cpumask_first(&iucv_buffer_cpumask), iucv_allow_cpu, NULL, 1); - return 0; + +__free_cpumask: + free_cpumask_var(cpumask); + return ret; } /** -- 2.9.5

2 1

[PATCH OLK-6.6] btrfs: zoned: fix use-after-free in do_zone_finish()
by Wang Zhaolong 05 Aug '24

05 Aug '24

From: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> mainline inclusion from mainline-v6.11-rc1 commit 1ec17ef59168a1a6f1105f5dc517f783839a5302 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5G2 CVE: CVE-2024-26944 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Shinichiro reported the following use-after-free triggered by the device replace operation in fstests btrfs/070. BTRFS info (device nullb1): scrub: finished on devid 1 with status: 0 ================================================================== BUG: KASAN: slab-use-after-free in do_zone_finish+0x91a/0xb90 [btrfs] Read of size 8 at addr ffff8881543c8060 by task btrfs-cleaner/3494007 CPU: 0 PID: 3494007 Comm: btrfs-cleaner Tainted: G W 6.8.0-rc5-kts #1 Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020 Call Trace: <TASK> dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0x200/0x3e0 kasan_report+0xd8/0x110 ? do_zone_finish+0x91a/0xb90 [btrfs] ? do_zone_finish+0x91a/0xb90 [btrfs] do_zone_finish+0x91a/0xb90 [btrfs] btrfs_delete_unused_bgs+0x5e1/0x1750 [btrfs] ? __pfx_btrfs_delete_unused_bgs+0x10/0x10 [btrfs] ? btrfs_put_root+0x2d/0x220 [btrfs] ? btrfs_clean_one_deleted_snapshot+0x299/0x430 [btrfs] cleaner_kthread+0x21e/0x380 [btrfs] ? __pfx_cleaner_kthread+0x10/0x10 [btrfs] kthread+0x2e3/0x3c0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Allocated by task 3493983: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 btrfs_alloc_device+0xb3/0x4e0 [btrfs] device_list_add.constprop.0+0x993/0x1630 [btrfs] btrfs_scan_one_device+0x219/0x3d0 [btrfs] btrfs_control_ioctl+0x26e/0x310 [btrfs] __x64_sys_ioctl+0x134/0x1b0 do_syscall_64+0x99/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Freed by task 3494056: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3f/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x32/0x70 kfree+0x11b/0x320 btrfs_rm_dev_replace_free_srcdev+0xca/0x280 [btrfs] btrfs_dev_replace_finishing+0xd7e/0x14f0 [btrfs] btrfs_dev_replace_by_ioctl+0x1286/0x25a0 [btrfs] btrfs_ioctl+0xb27/0x57d0 [btrfs] __x64_sys_ioctl+0x134/0x1b0 do_syscall_64+0x99/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76 The buggy address belongs to the object at ffff8881543c8000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 96 bytes inside of freed 1024-byte region [ffff8881543c8000, ffff8881543c8400) The buggy address belongs to the physical page: page:00000000fe2c1285 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1543c8 head:00000000fe2c1285 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 0017ffffc0000840 ffff888100042dc0 ffffea0019e8f200 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881543c7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881543c7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8881543c8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881543c8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881543c8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb This UAF happens because we're accessing stale zone information of a already removed btrfs_device in do_zone_finish(). The sequence of events is as follows: btrfs_dev_replace_start btrfs_scrub_dev btrfs_dev_replace_finishing btrfs_dev_replace_update_device_in_mapping_tree <-- devices replaced btrfs_rm_dev_replace_free_srcdev btrfs_free_device <-- device freed cleaner_kthread btrfs_delete_unused_bgs btrfs_zone_finish do_zone_finish <-- refers the freed device The reason for this is that we're using a cached pointer to the chunk_map from the block group, but on device replace this cached pointer can contain stale device entries. The staleness comes from the fact, that btrfs_block_group::physical_map is not a pointer to a btrfs_chunk_map but a memory copy of it. Also take the fs_info::dev_replace::rwsem to prevent btrfs_dev_replace_update_device_in_mapping_tree() from changing the device underneath us again. Note: btrfs_dev_replace_update_device_in_mapping_tree() is holding fs_info::mapping_tree_lock, but as this is a spinning read/write lock we cannot take it as the call to blkdev_zone_mgmt() requires a memory allocation which may not sleep. But btrfs_dev_replace_update_device_in_mapping_tree() is always called with the fs_info::dev_replace::rwsem held in write mode. Many thanks to Shinichiro for analyzing the bug. Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> CC: stable(a)vger.kernel.org # 6.8 Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/zoned.c [The current code does not introduce the struct btrfs_chunk_map] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/btrfs/zoned.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c index 2784f6cb4482..8c0ad5dc06f6 100644 --- a/fs/btrfs/zoned.c +++ b/fs/btrfs/zoned.c @@ -1476,11 +1476,7 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new) map = em->map_lookup; - cache->physical_map = kmemdup(map, map_lookup_size(map->num_stripes), GFP_NOFS); - if (!cache->physical_map) { - ret = -ENOMEM; - goto out; - } + cache->physical_map = map; zone_info = kcalloc(map->num_stripes, sizeof(*zone_info), GFP_NOFS); if (!zone_info) { @@ -1583,7 +1579,6 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new) } bitmap_free(active); kfree(zone_info); - free_extent_map(em); return ret; } @@ -2084,6 +2079,7 @@ static int do_zone_finish(struct btrfs_block_group *block_group, bool fully_writ struct map_lookup *map; const bool is_metadata = (block_group->flags & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_SYSTEM)); + struct btrfs_dev_replace *dev_replace = &fs_info->dev_replace; int ret = 0; int i; @@ -2159,6 +2155,7 @@ static int do_zone_finish(struct btrfs_block_group *block_group, bool fully_writ btrfs_clear_data_reloc_bg(block_group); spin_unlock(&block_group->lock); + down_read(&dev_replace->rwsem); map = block_group->physical_map; for (i = 0; i < map->num_stripes; i++) { struct btrfs_device *device = map->stripes[i].dev; @@ -2173,13 +2170,16 @@ static int do_zone_finish(struct btrfs_block_group *block_group, bool fully_writ zinfo->zone_size >> SECTOR_SHIFT, GFP_NOFS); - if (ret) + if (ret) { + up_read(&dev_replace->rwsem); return ret; + } if (!(block_group->flags & BTRFS_BLOCK_GROUP_DATA)) zinfo->reserved_active_zones++; btrfs_dev_clear_active_zone(device, physical); } + up_read(&dev_replace->rwsem); if (!fully_written) btrfs_dec_block_group_ro(block_group); -- 2.34.3

2 1

[PATCH OLK-5.10 0/2] blk-wbt: don't throttle swap writes in direct reclaim
by Yu Kuai 05 Aug '24

05 Aug '24

Baokun Li (1): blk-wbt: don't throttle swap writes in direct reclaim Christoph Hellwig (1): blk-wbt: move private information from blk-wbt.h to blk-wbt.c block/blk-mq-sched.c | 1 + block/blk-settings.c | 1 + block/blk-sysfs.c | 1 + block/blk-wbt.c | 91 ++++++++++++++++++++++++++++++++++++++++---- block/blk-wbt.h | 86 ----------------------------------------- block/elevator.c | 1 + 6 files changed, 88 insertions(+), 93 deletions(-) -- 2.39.2

2 3

[PATCH v2 OLK-6.6] s390/pkey: Wipe copies of clear-key structures on failure
by Li Huafei 05 Aug '24

05 Aug '24

From: Holger Dengler <dengler(a)linux.ibm.com> mainline inclusion from mainline-v6.10-rc1 commit d65d76a44ffe74c73298ada25b0f578680576073 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAH6LY CVE: CVE-2024-42156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key. Reviewed-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Ingo Franzki <ifranzki(a)linux.ibm.com> Acked-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Holger Dengler <dengler(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Conflicts: drivers/s390/crypto/pkey_api.c [ Resolved context conflict due to commit 6d749b4e0208 ("s390/pkey: introduce dynamic debugging for pkey") not backport. ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/s390/crypto/pkey_api.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c index 436de137a3bc..ab73c1135943 100644 --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1365,9 +1365,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, rc = cca_clr2seckey(kcs.cardnr, kcs.domain, kcs.keytype, kcs.clrkey.clrkey, kcs.seckey.seckey); DEBUG_DBG("%s cca_clr2seckey()=%d\n", __func__, rc); - if (rc) - break; - if (copy_to_user(ucs, &kcs, sizeof(kcs))) + if (!rc && copy_to_user(ucs, &kcs, sizeof(kcs))) rc = -EFAULT; memzero_explicit(&kcs, sizeof(kcs)); break; @@ -1399,9 +1397,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, kcp.protkey.protkey, &kcp.protkey.len, &kcp.protkey.type); DEBUG_DBG("%s pkey_clr2protkey()=%d\n", __func__, rc); - if (rc) - break; - if (copy_to_user(ucp, &kcp, sizeof(kcp))) + if (!rc && copy_to_user(ucp, &kcp, sizeof(kcp))) rc = -EFAULT; memzero_explicit(&kcp, sizeof(kcp)); break; @@ -1550,11 +1546,14 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (copy_from_user(&kcs, ucs, sizeof(kcs))) return -EFAULT; apqns = _copy_apqns_from_user(kcs.apqns, kcs.apqn_entries); - if (IS_ERR(apqns)) + if (IS_ERR(apqns)) { + memzero_explicit(&kcs, sizeof(kcs)); return PTR_ERR(apqns); + } kkey = kzalloc(klen, GFP_KERNEL); if (!kkey) { kfree(apqns); + memzero_explicit(&kcs, sizeof(kcs)); return -ENOMEM; } rc = pkey_clr2seckey2(apqns, kcs.apqn_entries, @@ -1564,15 +1563,18 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, kfree(apqns); if (rc) { kfree_sensitive(kkey); + memzero_explicit(&kcs, sizeof(kcs)); break; } if (kcs.key) { if (kcs.keylen < klen) { kfree_sensitive(kkey); + memzero_explicit(&kcs, sizeof(kcs)); return -EINVAL; } if (copy_to_user(kcs.key, kkey, klen)) { kfree_sensitive(kkey); + memzero_explicit(&kcs, sizeof(kcs)); return -EFAULT; } } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] gve: Account for stopped queues when reading NIC stats
by Zhang Changzhong 05 Aug '24

05 Aug '24

From: Shailend Chand <shailend(a)google.com> mainline inclusion from mainline-v6.10-rc1 commit af9bcf910b1f86244f39e15e701b2dc564b469a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGRY7 CVE: CVE-2024-42162 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array. Tested-by: Mina Almasry <almasrymina(a)google.com> Reviewed-by: Praveen Kaligineedi <pkaligineedi(a)google.com> Reviewed-by: Harshitha Ramamurthy <hramamurthy(a)google.com> Signed-off-by: Shailend Chand <shailend(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/google/gve/gve_ethtool.c [several refactor and feature patches are not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/google/gve/gve_ethtool.c | 58 ++++++++++++++++++++++++--- 1 file changed, 52 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c index 22be6d6..180451ad 100644 --- a/drivers/net/ethernet/google/gve/gve_ethtool.c +++ b/drivers/net/ethernet/google/gve/gve_ethtool.c @@ -32,6 +32,22 @@ static u32 gve_get_msglevel(struct net_device *netdev) return priv->msg_enable; } +static bool gve_tx_was_added_to_block(struct gve_priv *priv, int queue_idx) +{ + struct gve_notify_block *block = + &priv->ntfy_blocks[gve_tx_idx_to_ntfy(priv, queue_idx)]; + + return block->tx != NULL; +} + +static bool gve_rx_was_added_to_block(struct gve_priv *priv, int queue_idx) +{ + struct gve_notify_block *block = + &priv->ntfy_blocks[gve_rx_idx_to_ntfy(priv, queue_idx)]; + + return block->rx != NULL; +} + static const char gve_gstrings_main_stats[][ETH_GSTRING_LEN] = { "rx_packets", "tx_packets", "rx_bytes", "tx_bytes", "rx_dropped", "tx_dropped", "tx_timeouts", @@ -144,6 +160,8 @@ gve_get_ethtool_stats(struct net_device *netdev, struct stats *report_stats; int *rx_qid_to_stats_idx; int *tx_qid_to_stats_idx; + int num_stopped_rxqs = 0; + int num_stopped_txqs = 0; struct gve_priv *priv; bool skip_nic_stats; unsigned int start; @@ -158,12 +176,23 @@ gve_get_ethtool_stats(struct net_device *netdev, sizeof(int), GFP_KERNEL); if (!rx_qid_to_stats_idx) return; + for (ring = 0; ring < priv->rx_cfg.num_queues; ring++) { + rx_qid_to_stats_idx[ring] = -1; + if (!gve_rx_was_added_to_block(priv, ring)) + num_stopped_rxqs++; + } tx_qid_to_stats_idx = kmalloc_array(priv->tx_cfg.num_queues, sizeof(int), GFP_KERNEL); if (!tx_qid_to_stats_idx) { kfree(rx_qid_to_stats_idx); return; } + for (ring = 0; ring < priv->tx_cfg.num_queues; ring++) { + tx_qid_to_stats_idx[ring] = -1; + if (!gve_tx_was_added_to_block(priv, ring)) + num_stopped_txqs++; + } + for (rx_pkts = 0, rx_bytes = 0, rx_skb_alloc_fail = 0, rx_buf_alloc_fail = 0, rx_desc_err_dropped_pkt = 0, ring = 0; ring < priv->rx_cfg.num_queues; ring++) { @@ -229,7 +258,13 @@ gve_get_ethtool_stats(struct net_device *netdev, /* For rx cross-reporting stats, start from nic rx stats in report */ base_stats_idx = GVE_TX_STATS_REPORT_NUM * priv->tx_cfg.num_queues + GVE_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues; - max_stats_idx = NIC_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues + + /* The boundary between driver stats and NIC stats shifts if there are + * stopped queues. + */ + base_stats_idx += NIC_RX_STATS_REPORT_NUM * num_stopped_rxqs + + NIC_TX_STATS_REPORT_NUM * num_stopped_txqs; + max_stats_idx = NIC_RX_STATS_REPORT_NUM * + (priv->rx_cfg.num_queues - num_stopped_rxqs) + base_stats_idx; /* Preprocess the stats report for rx, map queue id to start index */ skip_nic_stats = false; @@ -243,6 +278,10 @@ gve_get_ethtool_stats(struct net_device *netdev, skip_nic_stats = true; break; } + if (queue_id < 0 || queue_id >= priv->rx_cfg.num_queues) { + net_err_ratelimited("Invalid rxq id in NIC stats\n"); + continue; + } rx_qid_to_stats_idx[queue_id] = stats_idx; } /* walk RX rings */ @@ -270,14 +309,15 @@ gve_get_ethtool_stats(struct net_device *netdev, data[i++] = rx->rx_copybreak_pkt; data[i++] = rx->rx_copied_pkt; /* stats from NIC */ - if (skip_nic_stats) { + stats_idx = rx_qid_to_stats_idx[ring]; + if (skip_nic_stats || stats_idx < 0) { /* skip NIC rx stats */ i += NIC_RX_STATS_REPORT_NUM; continue; } for (j = 0; j < NIC_RX_STATS_REPORT_NUM; j++) { u64 value = - be64_to_cpu(report_stats[rx_qid_to_stats_idx[ring] + j].value); + be64_to_cpu(report_stats[stats_idx + j].value); data[i++] = value; } @@ -288,7 +328,8 @@ gve_get_ethtool_stats(struct net_device *netdev, /* For tx cross-reporting stats, start from nic tx stats in report */ base_stats_idx = max_stats_idx; - max_stats_idx = NIC_TX_STATS_REPORT_NUM * priv->tx_cfg.num_queues + + max_stats_idx = NIC_TX_STATS_REPORT_NUM * + (priv->tx_cfg.num_queues - num_stopped_txqs) + max_stats_idx; /* Preprocess the stats report for tx, map queue id to start index */ skip_nic_stats = false; @@ -302,6 +343,10 @@ gve_get_ethtool_stats(struct net_device *netdev, skip_nic_stats = true; break; } + if (queue_id < 0 || queue_id >= priv->tx_cfg.num_queues) { + net_err_ratelimited("Invalid txq id in NIC stats\n"); + continue; + } tx_qid_to_stats_idx[queue_id] = stats_idx; } /* walk TX rings */ @@ -323,14 +368,15 @@ gve_get_ethtool_stats(struct net_device *netdev, data[i++] = be32_to_cpu(gve_tx_load_event_counter(priv, tx)); /* stats from NIC */ - if (skip_nic_stats) { + stats_idx = tx_qid_to_stats_idx[ring]; + if (skip_nic_stats || stats_idx < 0) { /* skip NIC tx stats */ i += NIC_TX_STATS_REPORT_NUM; continue; } for (j = 0; j < NIC_TX_STATS_REPORT_NUM; j++) { u64 value = - be64_to_cpu(report_stats[tx_qid_to_stats_idx[ring] + j].value); + be64_to_cpu(report_stats[stats_idx + j].value); data[i++] = value; } } -- 2.9.5

2 1

[PATCH OLK-6.6 0/1] CVE-2024-41079
by Yuntao Liu 05 Aug '24

05 Aug '24

CVE-2024-41079 Daniel Wagner (1): nvmet: always initialize cqe.result drivers/nvme/target/core.c | 1 + drivers/nvme/target/fabrics-cmd-auth.c | 3 --- drivers/nvme/target/fabrics-cmd.c | 6 ------ 3 files changed, 1 insertion(+), 9 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-42101
by Yuntao Liu 05 Aug '24

05 Aug '24

CVE-2024-42101 Ma Ke (1): [Backport] drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-42101
by Yuntao Liu 05 Aug '24

05 Aug '24

CVE-2024-42101 Ma Ke (1): [Backport] drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] cvm and coda part 1
by y00878127 05 Aug '24

05 Aug '24

2 2

[PATCH OLK-5.10] gve: Account for stopped queues when reading NIC stats
by Zhang Changzhong 05 Aug '24

05 Aug '24

From: Shailend Chand <shailend(a)google.com> mainline inclusion from mainline-v6.10-rc1 commit af9bcf910b1f86244f39e15e701b2dc564b469a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGRY7 CVE: CVE-2024-42162 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array. Tested-by: Mina Almasry <almasrymina(a)google.com> Reviewed-by: Praveen Kaligineedi <pkaligineedi(a)google.com> Reviewed-by: Harshitha Ramamurthy <hramamurthy(a)google.com> Signed-off-by: Shailend Chand <shailend(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/google/gve/gve_ethtool.c [several refactor and feature patches are not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/google/gve/gve_ethtool.c | 58 ++++++++++++++++++++++++--- 1 file changed, 52 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_ethtool.c b/drivers/net/ethernet/google/gve/gve_ethtool.c index 22be6d6..180451ad 100644 --- a/drivers/net/ethernet/google/gve/gve_ethtool.c +++ b/drivers/net/ethernet/google/gve/gve_ethtool.c @@ -32,6 +32,22 @@ static u32 gve_get_msglevel(struct net_device *netdev) return priv->msg_enable; } +static bool gve_tx_was_added_to_block(struct gve_priv *priv, int queue_idx) +{ + struct gve_notify_block *block = + &priv->ntfy_blocks[gve_tx_idx_to_ntfy(priv, queue_idx)]; + + return block->tx != NULL; +} + +static bool gve_rx_was_added_to_block(struct gve_priv *priv, int queue_idx) +{ + struct gve_notify_block *block = + &priv->ntfy_blocks[gve_rx_idx_to_ntfy(priv, queue_idx)]; + + return block->rx != NULL; +} + static const char gve_gstrings_main_stats[][ETH_GSTRING_LEN] = { "rx_packets", "tx_packets", "rx_bytes", "tx_bytes", "rx_dropped", "tx_dropped", "tx_timeouts", @@ -144,6 +160,8 @@ gve_get_ethtool_stats(struct net_device *netdev, struct stats *report_stats; int *rx_qid_to_stats_idx; int *tx_qid_to_stats_idx; + int num_stopped_rxqs = 0; + int num_stopped_txqs = 0; struct gve_priv *priv; bool skip_nic_stats; unsigned int start; @@ -158,12 +176,23 @@ gve_get_ethtool_stats(struct net_device *netdev, sizeof(int), GFP_KERNEL); if (!rx_qid_to_stats_idx) return; + for (ring = 0; ring < priv->rx_cfg.num_queues; ring++) { + rx_qid_to_stats_idx[ring] = -1; + if (!gve_rx_was_added_to_block(priv, ring)) + num_stopped_rxqs++; + } tx_qid_to_stats_idx = kmalloc_array(priv->tx_cfg.num_queues, sizeof(int), GFP_KERNEL); if (!tx_qid_to_stats_idx) { kfree(rx_qid_to_stats_idx); return; } + for (ring = 0; ring < priv->tx_cfg.num_queues; ring++) { + tx_qid_to_stats_idx[ring] = -1; + if (!gve_tx_was_added_to_block(priv, ring)) + num_stopped_txqs++; + } + for (rx_pkts = 0, rx_bytes = 0, rx_skb_alloc_fail = 0, rx_buf_alloc_fail = 0, rx_desc_err_dropped_pkt = 0, ring = 0; ring < priv->rx_cfg.num_queues; ring++) { @@ -229,7 +258,13 @@ gve_get_ethtool_stats(struct net_device *netdev, /* For rx cross-reporting stats, start from nic rx stats in report */ base_stats_idx = GVE_TX_STATS_REPORT_NUM * priv->tx_cfg.num_queues + GVE_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues; - max_stats_idx = NIC_RX_STATS_REPORT_NUM * priv->rx_cfg.num_queues + + /* The boundary between driver stats and NIC stats shifts if there are + * stopped queues. + */ + base_stats_idx += NIC_RX_STATS_REPORT_NUM * num_stopped_rxqs + + NIC_TX_STATS_REPORT_NUM * num_stopped_txqs; + max_stats_idx = NIC_RX_STATS_REPORT_NUM * + (priv->rx_cfg.num_queues - num_stopped_rxqs) + base_stats_idx; /* Preprocess the stats report for rx, map queue id to start index */ skip_nic_stats = false; @@ -243,6 +278,10 @@ gve_get_ethtool_stats(struct net_device *netdev, skip_nic_stats = true; break; } + if (queue_id < 0 || queue_id >= priv->rx_cfg.num_queues) { + net_err_ratelimited("Invalid rxq id in NIC stats\n"); + continue; + } rx_qid_to_stats_idx[queue_id] = stats_idx; } /* walk RX rings */ @@ -270,14 +309,15 @@ gve_get_ethtool_stats(struct net_device *netdev, data[i++] = rx->rx_copybreak_pkt; data[i++] = rx->rx_copied_pkt; /* stats from NIC */ - if (skip_nic_stats) { + stats_idx = rx_qid_to_stats_idx[ring]; + if (skip_nic_stats || stats_idx < 0) { /* skip NIC rx stats */ i += NIC_RX_STATS_REPORT_NUM; continue; } for (j = 0; j < NIC_RX_STATS_REPORT_NUM; j++) { u64 value = - be64_to_cpu(report_stats[rx_qid_to_stats_idx[ring] + j].value); + be64_to_cpu(report_stats[stats_idx + j].value); data[i++] = value; } @@ -288,7 +328,8 @@ gve_get_ethtool_stats(struct net_device *netdev, /* For tx cross-reporting stats, start from nic tx stats in report */ base_stats_idx = max_stats_idx; - max_stats_idx = NIC_TX_STATS_REPORT_NUM * priv->tx_cfg.num_queues + + max_stats_idx = NIC_TX_STATS_REPORT_NUM * + (priv->tx_cfg.num_queues - num_stopped_txqs) + max_stats_idx; /* Preprocess the stats report for tx, map queue id to start index */ skip_nic_stats = false; @@ -302,6 +343,10 @@ gve_get_ethtool_stats(struct net_device *netdev, skip_nic_stats = true; break; } + if (queue_id < 0 || queue_id >= priv->tx_cfg.num_queues) { + net_err_ratelimited("Invalid txq id in NIC stats\n"); + continue; + } tx_qid_to_stats_idx[queue_id] = stats_idx; } /* walk TX rings */ @@ -323,14 +368,15 @@ gve_get_ethtool_stats(struct net_device *netdev, data[i++] = be32_to_cpu(gve_tx_load_event_counter(priv, tx)); /* stats from NIC */ - if (skip_nic_stats) { + stats_idx = tx_qid_to_stats_idx[ring]; + if (skip_nic_stats || stats_idx < 0) { /* skip NIC tx stats */ i += NIC_TX_STATS_REPORT_NUM; continue; } for (j = 0; j < NIC_TX_STATS_REPORT_NUM; j++) { u64 value = - be64_to_cpu(report_stats[tx_qid_to_stats_idx[ring] + j].value); + be64_to_cpu(report_stats[stats_idx + j].value); data[i++] = value; } } -- 2.9.5

2 1

[PATCH OLK-6.6 0/1] CVE-2024-41079
by Yuntao Liu 05 Aug '24

05 Aug '24

CVE-2024-41079 Daniel Wagner (1): nvmet: always initialize cqe.result drivers/nvme/target/core.c | 1 + drivers/nvme/target/fabrics-cmd-auth.c | 3 --- drivers/nvme/target/fabrics-cmd.c | 6 ------ 3 files changed, 1 insertion(+), 9 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 05 Aug '24

05 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): wvfio modify drivers/vfio/pci/vfio_pci_core.c | 5 ++ include/linux/iommu.h | 9 +++ include/linux/iopoll.h | 38 ++++++++++ include/linux/pci.h | 4 + include/linux/vfio.h | 5 ++ include/uapi/linux/vfio.h | 3 + virt/kvm/vfio.c | 121 ++++++++++++++++++++++++++++++- virt/kvm/vfio.h | 10 +++ 8 files changed, 194 insertions(+), 1 deletion(-) -- 2.25.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-41079
by Yuntao Liu 05 Aug '24

05 Aug '24

CVE-2024-41079 Daniel Wagner (1): nvmet: always initialize cqe.result drivers/nvme/target/core.c | 1 + drivers/nvme/target/fabrics-cmd.c | 6 ------ 2 files changed, 1 insertion(+), 6 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-41079
by Yuntao Liu 05 Aug '24

05 Aug '24

CVE-2024-41079 Daniel Wagner (1): [Backport] nvmet: always initialize cqe.result drivers/nvme/target/core.c | 1 + drivers/nvme/target/fabrics-cmd.c | 6 ------ 2 files changed, 1 insertion(+), 6 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 05 Aug '24

05 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): wvfio modify drivers/vfio/pci/vfio_pci_core.c | 5 ++ include/linux/iommu.h | 9 +++ include/linux/iopoll.h | 38 ++++++++++ include/linux/pci.h | 4 + include/linux/vfio.h | 5 ++ include/uapi/linux/vfio.h | 3 + virt/kvm/vfio.c | 121 ++++++++++++++++++++++++++++++- virt/kvm/vfio.h | 10 +++ 8 files changed, 194 insertions(+), 1 deletion(-) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 05 Aug '24

05 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): wvfio modify drivers/vfio/pci/vfio_pci_core.c | 5 ++ include/linux/iommu.h | 9 +++ include/linux/iopoll.h | 38 ++++++++++ include/linux/pci.h | 4 + include/linux/vfio.h | 5 ++ include/uapi/linux/vfio.h | 3 + virt/kvm/vfio.c | 121 ++++++++++++++++++++++++++++++- virt/kvm/vfio.h | 10 +++ 8 files changed, 194 insertions(+), 1 deletion(-) -- 2.25.1

2 2

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 05 Aug '24

05 Aug '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): wvfio modify drivers/vfio/pci/vfio_pci_core.c | 5 ++ include/linux/iommu.h | 9 +++ include/linux/iopoll.h | 38 ++++++++++ include/linux/pci.h | 4 + include/linux/vfio.h | 5 ++ include/uapi/linux/vfio.h | 3 + virt/kvm/vfio.c | 121 ++++++++++++++++++++++++++++++- virt/kvm/vfio.h | 10 +++ 8 files changed, 194 insertions(+), 1 deletion(-) -- 2.25.1

2 2